CVE-2025-40758

A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.

• CWE-347

• https://cert-portal.siemens.com/productcert/html/ssa-395458.html

Published

Aug 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4075A vulnerability was found in VMSMan up to 20250416. It has b…5.3
• CVE-2025-40751A vulnerability has been identified in SIMATIC RTLS Locating…7.8
• CVE-2025-40752A vulnerability has been identified in POWER METER SICAM Q10…6.8
• CVE-2025-40753A vulnerability has been identified in POWER METER SICAM Q10…6.8
• CVE-2025-40755A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2025-40757A vulnerability has been identified in APOGEE PXC Series (BA…6.3
• CVE-2025-40759A vulnerability has been identified in SIMATIC S7-PLCSIM V17…8.5
• CVE-2025-4076A vulnerability classified as critical has been found in LB-…6.3
• CVE-2025-40760A vulnerability has been identified in Altair Grid Engine (A…6.8
• CVE-2025-40761A vulnerability has been identified in RUGGEDCOM ROX MX5000 …8.6
• CVE-2025-40762A vulnerability has been identified in Simcenter Femap V2406…7.8
• CVE-2025-40763A vulnerability has been identified in Altair Grid Engine (A…8.5