From 9f8f63ec17fc30bda33eafcc2fd0bd433419157e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 23 Mar 2026 10:27:14 +0000
Subject: [PATCH] Fix authlib security vulnerabilities: upgrade 1.6.6 -> 1.6.9

Fixes four CVEs:
- OIDC hash binding fail-open cryptographic verification
- JWE RSA1_5 Bleichenbacher padding oracle
- alg:none signature verification bypass
- JWS JWK header injection signature verification bypass

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/beb47db2-da25-416a-8fb0-c1452a3b22a7
---
 backend/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index fcaaa0c..aba2bfd 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -14,7 +14,7 @@ asyncpg==0.29.0
 python-jose[cryptography]==3.3.0
 passlib[bcrypt]==1.7.4
 python-multipart==0.0.22  # Updated: Fixed multiple vulnerabilities (was 0.0.6)
-authlib==1.6.6  # Updated: Fixed algorithm confusion and DoS vulnerabilities (was 1.3.0)
+authlib==1.6.9  # Updated: Fixed OIDC hash binding, JWE RSA1_5 padding oracle, alg:none bypass, JWK header injection (was 1.6.6)
 httpx==0.26.0
 
 # Payment Processing