Temporarily disabling SAML Identity Providers in Keycloak
Mitigation for CVE-2026-117691

Introduction

A critical vulnerability (CVE-2026-117691) has been identified in the SAML HTTP-Redirect binding implementation of Keycloak. This issue allows an attacker to bypass signature verification by using percent-encoded parameter names. This vulnerability affects all Mindbreeze InSpire appliances that have configured SAML Identity Providers (Keycloak SAML user federation).

An authenticated remote attacker can exploit this flaw to impersonate any federated user. By providing a crafted, unsigned SAML message, the attacker can bypass security checks and gain full account takeover of any user authenticated via SAML.

If you are using a version that is older than the Mindbreeze InSpire 26.7 Hotfix 3 Release, please perform the manual mitigation steps in the following chapters.

The Mindbreeze InSpire 26.7 Hotfix 3 Release fixes this vulnerability by blocking the problematic HTTP requests to Keycloak. A non-vulnerable Keycloak version will be provided in an upcoming Mindbreeze InSpire Release.

Attention: After the installation of Mindbreeze InSpire 26.7 Hotfix 3 Release or newer, make sure to manually re-enable the SAML Identity Providers to function.

Check for affectedness

The default configuration is not affected by CVE-2026-117691.

Perform the following steps on all member nodes of a Mindbreeze InSpire cluster to see, if you are affected:

1. Sign in to the Mindbreeze InSpire Management Center.
2. Navigate to Setup > Credentials.
3. For each realm (by default, only the master realm exists), do the following:
   1. Select Identity providers.
   2. Check the Provider details column.
   3. If no identity providers are configured, or if no providers use SAML, no action is required.
   4. If any provider is set to SAML, your configuration is potentially affected. Follow the Mitigation steps below.

Mitigation

Attention: Be aware, that this mitigation prevents federated SAML users from signing in via Keycloak. If not used otherwise, it prevents federated users from accessing the Mindbreeze Management Center. Local users and users from non-SAML federated identity providers are not affected.

If your setup is affected, perform these steps on all member nodes of the Mindbreeze InSpire cluster to mitigate the critical vulnerability:

1. Sign in to the Mindbreeze InSpire Management Center.
2. Navigate to Setup > Credentials.
3. For each realm, do the following:
   1. Select Identity providers.
   2. For every identity provider where Provider details is SAML:
      1. Click the Entity Provider
      2. Toggle the Enabled switch in the top right.
      3. Click Disable

The mitigation is now completed.

Verification

Check all realms to ensure the mitigation was successful. If configured correctly, all SAML identity

providers display a “disabled” marker next to their name.