CVE-2025-40758: Mendix SAML Module Allows Remote Account Hijack (CVSS 8.7)

Siemens’ Mendix SAML module contains a high‑severity flaw that, under certain single sign‑on (SSO) configurations, can allow unauthenticated remote attackers to bypass SAML signature verification and hijack user accounts — a vulnerability tracked as CVE‑2025‑40758 with a CVSS v3.1 base score of 8.7. (cert-portal.siemens.com) (cisa.gov)

Background​

Siemens ProductCERT published advisory SSA‑395458 on August 14, 2025, confirming that affected Mendix SAML module versions “insufficiently enforce signature validation and binding checks,” creating opportunities for account takeover in particular SSO topologies. The vendor’s guidance points operators to specific fixed module releases and recommends enabling encryption where appropriate. (cert-portal.siemens.com)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) republished the advisory on August 19, 2025 as ICSA‑25‑231‑02, restating the basic facts, the CVSS score, and Siemens’ mitigation guidance while reminding operators that CISA will not provide ongoing updates for Siemens advisories beyond the initial republication. (cisa.gov)
A number of vulnerability trackers and security vendors have cataloged the CVE and remedial versions, providing independent confirmation of Siemens’ affected‑version list and severity calculation. Note that vendor advisories and industry trackers together form the most reliable picture of technical details and remediation status at publication time. (tenable.com, securityvulnerability.io)
(Uploaded advisory excerpts provided by the user match the public advisory text and recommended mitigations.)

---

Executive summary for Windows and enterprise defenders​

• Vulnerability: Improper verification of cryptographic signature in the Mendix SAML module (CWE‑347).
• CVE: CVE‑2025‑40758; CVSS v3.1 base score 8.7 (high). (cert-portal.siemens.com, tenable.com)
• Affected components:
• Mendix SAML (Mendix 9.24 compatible): versions prior to V3.6.21.
• Mendix SAML (Mendix 10.12 compatible): versions prior to V4.0.3.
• Mendix SAML (Mendix 10.21 compatible): versions prior to V4.1.2. (cert-portal.siemens.com)
• Impact: Account hijack via crafted SAML messages when SSO is configured in certain ways; exploitable remotely but with high attack complexity as assessed by CISA. (cisa.gov)
• Vendor remediation: Patch/upgrades available for the module tracks listed above; immediate workaround: ensure configurations where UseEncryption is enabled. (cert-portal.siemens.com)

---

What the vulnerability actually is (technical overview)​

How SAML signature verification normally works​

SAML is a federated authentication protocol: an Identity Provider (IdP) issues a signed SAML assertion or response, and the Service Provider (SP — here, the Mendix application using the SAML module) must validate the cryptographic signature and certain binding checks (e.g., that the assertion corresponds to the expected request, correct destination, and expected relay state). Failure to validate these checks can allow a crafted message to appear legitimate when it is not.

The root cause in Mendix SAML​

According to Siemens, affected Mendix SAML module versions do not sufficiently enforce signature validation and binding checks. That deficit is categorized under CWE‑347 (Improper Verification of Cryptographic Signature). When an SP accepts SAML messages without robust signature enforcement or improperly handles the various SAML bindings, an attacker can craft messages to impersonate legitimate IdP assertions and cause the SP to create or authenticate sessions for attacker‑controlled identities. (cert-portal.siemens.com)

Exploitation path and realistic constraints​

• Attack vector: Network (remote). CVSS vector indicates a network attack vector with changed scope. (cert-portal.siemens.com)
• Privileges required: None — an unauthenticated attacker can attempt to send SAML messages. (cert-portal.siemens.com)
• Attack complexity: High — successful exploitation requires specific SSO configurations and often precise control of SAML flow elements. CISA explicitly notes the high attack complexity, which implies exploitability is nontrivial in many deployments. (cisa.gov)
• Real‑world exploitation: As of the vendor and CISA advisories’ publication, no confirmed public exploitation was reported; this absence should not be read as safety — attackers frequently probe federated auth endpoints and may develop tailored exploits privately. (cisa.gov)

---

Affected products and exact fixed versions​

Siemens lists three Mendix SAML module tracks and their minimum fixed versions:

• Mendix 9.24 compatible: update to V3.6.21 or later. (cert-portal.siemens.com)
• Mendix 10.12 compatible: update to V4.0.3 or later. (cert-portal.siemens.com)
• Mendix 10.21 compatible: update to V4.1.2 or later. (cert-portal.siemens.com)

Third‑party trackers and vulnerability management vendors mirror these version targets; for example, Tenable and other vulnerability feeds list the same affected versions and point back to Siemens’ product advisory. Cross‑checking these independent listings helps confirm the remediation targets are consistent across the ecosystem. (tenable.com, securityvulnerability.io)
If you manage Mendix applications, check your application’s module list (either via Mendix Studio Pro or the runtime logs) to identify the installed SAML module version and ensure it is at or beyond the fixed release for your Mendix track. Mendix’s own SAML documentation clarifies module versioning and compatibility with Mendix runtime versions. (docs.mendix.com)

---

Why Windows system administrators and enterprise security teams should care​

Many industrial and enterprise environments run Mendix applications on Windows‑based infrastructure — either as hosted web apps, backend services, or engineering portals that depend on Windows servers and operator workstations. A compromised application account through SAML abuse can lead to:

• Unauthorized access to dashboards, control panels, or administrative functions running on Windows hosts.
• Lateral movement from compromised web‑app sessions into backend systems, especially when single sign‑on is used as the central identity mechanism.
• Data exfiltration from applications that integrate with corporate file shares and Windows file servers.
• Privilege escalation if the compromised account is linked to administrative roles, or if the application proxies requests to privileged Windows services.

A successful account hijack in a manufacturing environment can be more consequential than a typical web app breach — integrity and safety of industrial processes may be at risk. CISA highlights Critical Manufacturing as an impacted sector. (cisa.gov)

---

Mitigation and remediation — immediate and medium‑term actions​

Immediate (within 24–72 hours)​

• Inventory and identify: Determine all Mendix applications in your estate and identify the SAML module version in use. Mendix module metadata is exposed in Studio Pro and runtime logs; cross‑check with your packaging and deployment pipelines. (docs.mendix.com)
• Enable UseEncryption where supported: As an immediate configuration mitigation, ensure SAML configurations use encryption for assertions/responses where the option is available. Siemens specifically calls this out as a recommended mitigation. This is a stopgap — not a substitute for the fixed module. (cert-portal.siemens.com)
• Restrict network exposure: Make sure SAML endpoints and management interfaces are not exposed to the public internet. Place Mendix application hosts behind firewalls, WAFs, and VPC security groups; use network segmentation to reduce the attacker surface. CISA reiterates this defensive posture. (cisa.gov)
• Apply monitoring: Boost authentication monitoring and logging. Look for anomalous SAML responses, unexpected assertion issuers, or suspicious login/SSO patterns. Raise alert thresholds for sudden account creations or multiple SSO logins from unfamiliar sources.

Patching (recommended as soon as operationally feasible)​

• Test the vendor fix in staging: Download and validate the fixed module version against your application’s SSO flows in a staging environment, verifying all IdP integrations and single logout behaviors. Validate through both HTTP‑POST and HTTP‑Redirect bindings as used in your environment. (cert-portal.siemens.com, docs.mendix.com)
• Schedule controlled rollouts: Apply the module update in a controlled maintenance window. If you have multiple Mendix environments (dev/test/stage/prod), roll out progressively from least to most critical.
• Post‑patch verification: Confirm signature enforcement, binding checks, and encryption settings are functioning as expected. Run synthetic logins from test IdPs and verify failure behavior for tampered signatures.

Medium‑term (weeks to months)​

• Conduct SSO threat modeling: Reassess SAML configurations across applications. Where possible, prefer OIDC (OpenID Connect) for modern SSO, as Mendix documentation suggests OIDC SSO as an easier‑to‑use, more modern alternative. If OIDC is viable with your IdP landscape, build a migration plan. (docs.mendix.com)
• Harden IdP‑SP trust model: Ensure IdP metadata is pinned/validated; do not accept dynamic metadata updates without a controlled pipeline. Implement certificate rotation policies and monitor for unauthorized metadata changes.
• Review least privilege and role mappings: Avoid granting application users elevated privileges by default; map SAML attributes to roles conservatively.

---

Detection and incident response playbook​

• Search logs for anomalous SAML flows: Look for SAML assertions that appear unsigned, have unexpected Issuer values, or contain unusual RelayState values.
• Check audit trails for unexpected account creations or admin logins: Correlate with network logs and VPN sessions.
• If compromise suspected:
• Isolate affected application instances.
• Revoke sessions / force SSO re‑authentication for affected accounts.
• Rotate SP keypairs and inform IdP operators of potential key compromise if any key material may have leaked.
• Conduct a forensic timeline of authentication events and preserve evidence for legal/regulatory needs.
• Report and coordinate: Inform your vendor representative and, where appropriate, national CERT or CISA if you observe exploitation, per the reporting guidance in the advisories. CISA asks organizations to follow internal procedures and report observed malicious activity for correlation. (cisa.gov)

---

Hardening SAML configurations — practical checklist​

• Enable encryption of SAML assertions/responses (UseEncryption = true). (cert-portal.siemens.com)
• Require signed assertions and/or signed responses depending on your IdP/SP trust model.
• Enforce destination and audience checks on incoming assertions.
• Validate RelayState semantics and length; do not accept arbitrary RelayState values without verification.
• Pin IdP metadata or verify metadata via a signed metadata source.
• Use short assertion validity windows (IssueInstant/NotOnOrAfter) and validate them strictly.
• Monitor certificate expirations and implement rotation procedures.
• Maintain a minimal attack surface: only allow IdP endpoints from trusted IP ranges where possible.

---

Operational guidance for Windows environments​

• Windows web servers hosting Mendix applications should be patched and run modern TLS configurations. Disable legacy TLS versions and weak cipher suites on application servers that terminate SAML traffic. This reduces the risk of transport‑level tampering that might aid an attacker. (docs.mendix.com)
• Ensure Windows firewall and network ACLs prevent direct internet access to application management endpoints. Use reverse proxies and web application firewalls as an intermediate control to drop malformed SAML traffic or requests missing expected headers. (cisa.gov)
• If Windows servers are part of domain SSO flows, review Active Directory federation services (AD FS) configurations to ensure they are not accepting unexpected SAML assertion types or unsigned responses.

---

Assessing the real operational risk​

The advisory’s CVSS and vendor statement indicate a realistic, high‑impact risk where the vulnerability is present and the SSO configuration is permissive or nonstandard. However, CISA’s note of high attack complexity is important: many environments will not be trivially exploitable because exploit success often requires:

• A specific SSO topology (IdP‑initiated vs SP‑initiated),
• Misconfiguration or permissive defaults (e.g., disabled encryption or lax binding checks),
• The ability to deliver crafted SAML messages to the SP (network reachability).

Therefore, organizational context matters. Environments that run public‑facing Mendix applications with SSO endpoints reachable to broad networks should prioritize remediation; isolated internal deployments with strict network controls may have a different urgency profile. Cross‑validation against independent trackers (Tenable, security feeds) confirms the vulnerability details and remediation targets, providing additional confidence in prioritization decisions. (tenable.com, securityvulnerability.io)

---

Why recurring SAML issues matter — systemic perspective​

SAML remains widely used in enterprise and industrial contexts, but correct implementation is complex: multiple bindings, signature placement (response vs assertion), encryption options, RelayState handling, and metadata management all present pitfalls. Siemens’ Mendix SAML module has had earlier SAML‑related advisories and fixes (histor advisories and CVEs address replay, assertion verification, and XSS issues), demonstrating that SAML implementation is a recurring area of concern for software vendors. Administrators should treat federated auth components as high‑risk subsystems and apply disciplined change control and testing for any SSO configuration changes. (cert-portal.siemens.com)

---

Practical timeline and verification steps for operators​

• Immediately identify Mendix SAML module versions in all environments (inventory). (docs.mendix.com)
• If any environment runs impacted versions (pre‑V3.6.21, pre‑V4.0.3, pre‑V4.1.2), schedule patching within the next maintenance window — prioritize public‑facing or high‑value environments. (cert-portal.siemens.com)
• In parallel, enable UseEncryption or equivalent encryption settings where supported. Treat this as temporary mitigation, not a replacement for the fix. (cert-portal.siemens.com)
• Test patched modules in staging with all IdP integrations and with negative tests (tampered signatures, wrong audience, mismatched destination).
• Roll out to production and monitor authentication telemetry for anomalies for at least 30 days post‑deployment.

---

Caveats and unverifiable items​

• There is no public proof‑of‑concept code posted with the advisory at the time of publication; however, the technical vector is well understood (signature/binding bypass) and therefore plausible for targeted exploitation. The absence of a PoC does not mean an exploit is infeasible. (cisa.gov, cert-portal.siemens.com)
• The advisories classify attack complexity as high; whether that holds across all real‑world deployments depends on specific configuration choices (e.g., whether UseEncryption is enabled, whether the IdP enforces signing, and how RelayState is handled). Operators must validate their actual configuration to assess true exposure. (cisa.gov)

---

Conclusion — prioritized action list​

• Inventory: Find all Mendix apps and their SAML module versions. (docs.mendix.com)
• Mitigate: Enable UseEncryption and restrict network exposure of SAML endpoints. (cert-portal.siemens.com, cisa.gov)
• Patch: Upgrade Mendix SAML to V3.6.21 / V4.0.3 / V4.1.2 (as applicable) after testing. (cert-portal.siemens.com)
• Monitor: Increase SSO/authentication monitoring and validate audit trails for anomalous SAML activity. (cisa.gov)
• Harden: Reassess SAML vs OIDC options and implement long‑term SSO best practices and certificate management. (docs.mendix.com)

The Mendix SAML CVE‑2025‑40758 advisory is a timely reminder that federated authentication components are mission‑critical and deserve prioritized patching, careful configuration, and continuous monitoring — especially in industrial and manufacturing settings where the consequences of account compromise can extend beyond data loss to operational and safety impacts. The public advisories from Siemens and CISA, and corroboration from vulnerability trackers, provide the precise version targets and configuration mitigations necessary to act now. (cert-portal.siemens.com, cisa.gov, tenable.com)
(Uploaded advisory excerpts included in the working material confirm the same remediation and mitigation steps cited above.)

---

Source: CISA Siemens Mendix SAML Module | CISA