diff --git a/backend/requirements.txt b/backend/requirements.txt
index fcaaa0c..aba2bfd 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -14,7 +14,7 @@ asyncpg==0.29.0
 python-jose[cryptography]==3.3.0
 passlib[bcrypt]==1.7.4
 python-multipart==0.0.22  # Updated: Fixed multiple vulnerabilities (was 0.0.6)
-authlib==1.6.6  # Updated: Fixed algorithm confusion and DoS vulnerabilities (was 1.3.0)
+authlib==1.6.9  # Updated: Fixed OIDC hash binding, JWE RSA1_5 padding oracle, alg:none bypass, JWK header injection (was 1.6.6)
 httpx==0.26.0
 
 # Payment Processing