Skip to content
OpenAdvisories
Low SSA-726617 1 CVE

SSA-726617: Incorrect Privilege Assignment Vulnerability in Mendix OIDC SSO Module

Published May 13, 2025 · Updated Apr 14, 2026 · Revision 5

Vendor: Siemens Product: Mendix OIDC SSO (Mendix 10.12 compatible) Product: Mendix OIDC SSO (Mendix 9 compatible) Product: Mendix OIDC SSO V4.2 (Mendix 10 compatible) Product: Mendix OIDC SSO V4.3 (Mendix 10 compatible)

Summary

The Mendix OIDC SSO module grants read and write access to all tokens exclusively to the Administrator role and could result in privilege misuse by an adversary modifying the module during Mendix development.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #5

    Corrected remediation for Mendix OIDC SSO (Mendix 9 compatible) and Mendix OIDC SSO (Mendix 10 compatible)

  2. #4

    Added fix for Mendix OIDC SSO (Mendix 9 compatible)

  3. #3

    Added fix for Mendix OIDC SSO (Mendix 10.12 compatible)

  4. #2

    Corrected remediation for Mendix OIDC SSO (Mendix 10 compatible)

  5. #1

    Publication Date

References