A critical vulnerability in Siemens Mendix SAML modules may allow unauthenticated attackers to perform account hijacking via improper cryptographic signature verification.

The vulnerability involves insufficient enforcement of signature validation and binding checks within the SAML module. This flaw allows an unauthenticated remote attacker to bypass authentication mechanisms and hijack user accounts in specific SSO deployments.

The exploitation of this vulnerability poses a severe risk to organizational security, as it facilitates unauthorized account access and potential identity theft within the Mendix ecosystem. With a CVSS score of 8.7, this vulnerability is classified as High severity, reflecting the significant potential for total compromise of confidentiality and integrity for affected user accounts.

Immediate Action: Update the affected Mendix SAML modules to versions V4.0.3, V4.1.2, or V3.6.21 respectively, based on the specific Mendix platform version in use.

Proactive Monitoring: Review authentication and SSO logs for anomalous login patterns, such as multiple successful authentications from unexpected sources or unusual session token behavior.

Compensating Controls: Ensure that strict network-level access controls are in place for the SSO endpoint and evaluate the implementation of secondary authentication factors where supported to mitigate the risk of successful hijacking.

Public Exploit Available: Unknown

Given the potential for account hijacking, organizations utilizing Siemens Mendix SAML must prioritize these updates. Administrators should verify their current module versions against the provided fixed releases and apply the patches during the next maintenance window to ensure the integrity of the single sign-on environment.