{"id":"CVE-2025-40758","aliases":["EUVD-2025-24824","GHSA-jcx5-8f6x-5fx8"],"status":"published","title":"A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions \u003c V4.0...","description":"A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions \u003c V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions \u003c V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions \u003c V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0026,"percentile":0.17738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2025-08-14T15:06:31Z","modified":"2026-06-17T09:22:04Z","products":[{"vendor":"siemens","product":"mendix saml (mendix 10.12 compatible)"},{"vendor":"siemens","product":"mendix saml (mendix 10.21 compatible)"},{"vendor":"siemens","product":"mendix saml (mendix 9.24 compatible)"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-395458.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40758"},{"url":"https://github.com/advisories/GHSA-jcx5-8f6x-5fx8"}],"sources":{"cve":[{"id":"CVE-2025-40758","description":"A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions \u003c V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions \u003c V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions \u003c V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.","status":"published","published":"2025-08-14T15:06:31.691Z","modified":"2025-08-14T15:18:47.716Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-24824","description":"A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions \u003c V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions \u003c V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions \u003c V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.","status":"published","published":"2025-08-14T15:06:31Z","modified":"2025-08-14T15:18:47Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:31:57.953552Z"}],"ghsa":[{"id":"GHSA-jcx5-8f6x-5fx8","title":"A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions \u003c V4.0...","description":"A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions \u003c V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions \u003c V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions \u003c V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.","status":"published","published":"2025-08-14T15:30:45Z","modified":"2025-08-14T15:30:52Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:03:17.959289Z"}],"nvd":[{"id":"CVE-2025-40758","description":"A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions \u003c V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions \u003c V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions \u003c V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.","status":"published","published":"2025-08-14T15:15:36.133Z","modified":"2026-06-17T09:22:04.977Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:11:23.594522Z"}]}}