CVE-2025-40758

Name of the Vulnerable Software and Affected Versions: Mendix SAML (Mendix 10.12 compatible) versions prior to 4.0.3 Mendix SAML (Mendix 10.21 compatible) versions prior to 4.1.2 Mendix SAML (Mendix 9.24 compatible) versions prior to 3.6.21

Description: The Mendix SAML module insufficiently enforces signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific Single Sign-On (SSO) configurations.

Recommendations: Update Mendix SAML (Mendix 10.12 compatible) to version 4.0.3 or later. Update Mendix SAML (Mendix 10.21 compatible) to version 4.1.2 or later. Update Mendix SAML (Mendix 9.24 compatible) to version 3.6.21 or later.