CVE-2025-40758: Siemens Mendix SAML Mendix 10.12 Compatible

High severity, CVSS 8.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.

Affected products

• Siemens Mendix SAML Mendix 10.12 Compatible: before V4.0.3 (fixed in V4.0.3)
• Siemens Mendix SAML Mendix 10.21 Compatible: before V4.1.2 (fixed in V4.1.2)
• Siemens Mendix SAML Mendix 9.24 Compatible: before V3.6.21 (fixed in V3.6.21)

Published 2025-08-14. Last modified 2026-06-17.