1. Blog
  2. Authentication
Curity Identity Server 11.6: Authentication Hardening and Unified Scope Management
On this page

Curity Identity Server 11.6 is out. It focuses on hardening authentication against enumeration and guessing attacks, a more capable scope management experience in the Admin UI and a broad refresh of the underlying runtime and dependencies. There are two main themes in this release: authentication hardening and the reworked scope management in the Admin UI.

Email and SMS authenticators can prevent account enumeration

A new prevent-account-enumeration option makes the authentication flow behave the same way whether a username resolves to an account or not, closing off a common way of discovering which addresses and numbers are registered. The option is disabled by default so behavior is unchanged on upgrade and you can turn it on when it suits your flows.

Throttling has been extended as well. A throttler can now be attached to the TOTP authenticator and to recovery-code verification in the Opt-In MFA authentication action so the second factor gets the same guessing protection as the first.

Configuration and database scopes now share one view in the Admin UI

Until now, configuration-backed scopes and database scopes lived in separate places. A new full-height scope picker brings them into a single unified view, with scope controls that behave consistently across clients. Scopes are sorted alphabetically in both the Admin UI and the DevOps Dashboard, without changing their stored order.

Changes to database scopes on the Scopes page are saved immediately so the separate save step is gone. Client and authenticator edit pages have also replaced their side navigation with a toolbar popout which frees up screen space, and the validation modal now leads with a plain-language message and keeps the technical detail collapsed underneath.

SAML signing keys can be rotated without downtime

The SAML2 Authenticator can be configured with a secondary request-signing key, so signing keys can be rotated between the identity provider and the Curity Identity Server without downtime.

The SAML IDP Service also now honors the NameID format configured on a service provider when issuing assertions.

Request logging is now configurable

Request parameters can be included only at DEBUG level, included at INFO or switched off entirely, and parameter values can be hidden. That makes it easier to keep detailed logs for troubleshooting without sensitive data ending up in them.

Two breaking changes in 11.6

Procedure references from a claims provider are now validated at configuration time instead of failing at runtime, and the handling of password reset links has changed, so links issued before the upgrade will be deemed invalid. Refer to the upgrade guide and product documentation for more details.

You can find the full release notes on the Developer Portal. On November 6th 2026 we will run a release webinar where the product management team will go through new features and updates. Register here.

Want to try it? Get started with a free trial and see what 11.6 can do for your architecture.

Jacob Ideskog

Written by

Jacob Ideskog

Jacob Ideskog is an Identity Specialist and CTO at Curity. Most of his time is spent working with security solutions in the API and Web space. He has worked with both designing and implementing OAuth and OpenID Connect solutions for large enterprise deployments as well as small startups.