# Keycloak 26.1.1 released

DevFeed: [Keycloak 26.1.1 released](<https://devfeed.tech/articles/keycloak-26-1-1-released-31685.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2025/02/keycloak-2611-released>)

Author: Keycloak Team

Published: 2025-02-05T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [LDAP](<https://devfeed.tech/topics/ldap.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [Quarkus](<https://devfeed.tech/topics/quarkus.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [idm](<https://devfeed.tech/tags/idm.md>), [ipv6](<https://devfeed.tech/tags/ipv6.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [node](<https://devfeed.tech/tags/node.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [password](<https://devfeed.tech/tags/password.md>), [quarkus](<https://devfeed.tech/tags/quarkus.md>), [release](<https://devfeed.tech/tags/release.md>), [release-notes](<https://devfeed.tech/tags/release-notes.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>), [x509](<https://devfeed.tech/tags/x509.md>)

## AI overview

Keycloak 26.1.1 adds an X.509 authenticator option to abort authentication when a configured CRL is outdated, and a reset-credential-email option to force a new login after credentials are reset. The release also lists resolved enhancements and bugs.

## Source excerpt

To download the release go to Keycloak downloads. Highlights New option in X.509 authenticator to abort authentication if CRL is outdated The X.509 authenticator has a new option x509-cert-auth-crl-abort-if-non-updated (CRL abort if non updated in the Admin Console) to abort the login if a CRL is configured to validate the certificate and the CRL is not updated in the time specified in the next update field. The new option defaults to true in the Admin Console. For more details about the CRL next update field, see RFC5280, Section-5.1.2.5. The value false is maintained for compatibility with the previous behavior. Note that existing configurations will not have the new option and will act as if this option was set to false, but the Admin Console will add the default value true on edit. New option in Send Reset Email to force a login after reset credentials The reset-credential-email (Send Reset Email) is the authenticator used in the reset credentials flow (forgot password feature) for sending the email to the user with the reset credentials token link. This authenticator now has a new option force-login (Force login after reset). When this option is set to true, the authenticator terminates the session and forces a new login. For more details about this new option, see Enable forgot password. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #552 Clean up old release code from Node.js adapter repo nodejs-connect #34275 Organizations: Allow Organization Selection organizations #34343 CreatedResponseUtil.getCreatedId should expose the actual error message from the server admin/client-java #36440 Remove Node.js adapter documentation from main repo docs #36456 Clarify IPv6 JGroups requirements in Keycloak documenation #36798 Add detail on dependencyManagement section for POM files Bugs #558 The draft nightly untagged release is created by "Release nightly" GH action nodejs-connect #562 Incorrectly r