BeyondInsight and Password Safe 26.2.3 release notes

❗
Important
This maintenance release supersedes all other previous 26.2.x releases. To see prior release versions, see Release notes page.

🆕 New features

This is a maintenance release. There are no new features.

✨ Enhancements

This is a maintenance release. There are no enhancements.

🛠️ Issues resolved

Product Area	Issue Description	Issue Resolution
Authentication	After an upgrade to version 26.2, SAML SSO logins fail with a server error on on-premises systems that use Azure SQL databases. Standard non-SAML logins continue to work normally.	BeyondInsight now correctly recognizes Azure SQL as a supported database platform during the upgrade process, and SAML SSO login works as expected after upgrading.
API	Public API requests fail intermittently with authentication errors or connection timeouts under heavy traffic. Load balancers send requests across multiple nodes that do not share active session data.	Public API sessions are now shared across all nodes, so a session established on one node is honored by every node behind the load balancer. Session handling also places much less load on the database, so API requests no longer time out intermittently.
Endpoint Privilege Management	Endpoint Privilege Management policies fail to match Entra ID user groups when organizations use Azure US Government tenants. Consequently, endpoints block user access and fail identity checks.	Entra ID group lookups from endpoints now use the cloud scope configured on the directory credential. For US Government tenants, group membership is retrieved successfully and Entra ID group filters in policy apply as expected.
Session Monitoring	Users may encounter an unexpected error message when they play back completed session recordings. This playback issue occurs intermittently, and retrying often succeeds.	Completed session recordings now play back reliably.
Password Management	When a scheduled password test of a Windows managed account takes longer than the managed system's connection timeout, Password Safe queues a Reset Password on Mismatch change even though the password was never checked. On slow networks this can cause unnecessary daily password rotations.	A password test that times out no longer queues a password reset, matching how connection failures are handled. A test that fails because of a wrong password still queues the reset.
Password Management – SAP	Password tests and changes for SAP managed accounts can fail when several run at the same time against different SAP systems. After extended uptime, the functional account test can hang and leave the console unresponsive.	Connections to each SAP system are now kept separate, so concurrent password operations succeed and repeated tests reuse connections reliably.
Resource Broker – Ticketing systems	On Resource Brokers that use a proxy server with direct outbound ports closed, ticket numbers on requests cannot be validated against the ticketing system because the request times out.	Ticket validation from the Resource Broker now goes through the configured proxy, and requests with valid tickets validate as expected.
Event Forwarding	When using a TCP or TCP SSL connector for event forwarding, BeyondInsight attempted to reuse connections that had been closed by the receiver due to inactivity. This resulted in the silent loss of event batches because the system did not detect the closed state before sending, and no retry mechanism was triggered for the failed delivery.	BeyondInsight now properly validates the connection state and ensures that events are successfully delivered or retried upon failure, preventing data loss when receivers close idle connections.
Password Safe	When a user checked in or canceled their own request while a session was still active, a Terminate Session audit event was incorrectly recorded against them. This occurred because the system did not distinguish between a requestor ending their own session and an administrator performing a privileged session termination.	The system now correctly identifies when a user ends their own session during request check-in or cancellation and no longer generates a Terminate Session audit or Session Review record in these cases. Privileged session terminations performed by administrators continue to be audited as expected.
Security – Third-party components	The bundled OpenSSL libraries required an update to address recently disclosed vulnerabilities.	The OpenSSL libraries bundled with BeyondInsight and the Resource Broker are updated to version 3.5.9
Oracle Internet Directory (OID) connections	When an Oracle managed system used Oracle Internet Directory with SSL, an invalid certificate caused a warning in the log and the connection continued.	Oracle Internet Directory (OID) connections over SSL now require a valid certificate. When an Oracle managed system uses Oracle Internet Directory with SSL, Password Safe now validates the OID server's certificate. Instead of a log warning, the connection will now fail if the certificate is invalid. This affects password verify, password change and account discovery on those systems, and the Test connection action for OID.