gitea-admin/gh-christianlouis-inboxconverge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix authlib security vulnerabilities: upgrade 1.6.6 -> 1.6.9

Browse Source 
Fixes four CVEs:
- OIDC hash binding fail-open cryptographic verification
- JWE RSA1_5 Bleichenbacher padding oracle
- alg:none signature verification bypass
- JWS JWK header injection signature verification bypass

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/beb47db2-da25-416a-8fb0-c1452a3b22a7
This commit is contained in:
copilot-swe-agent[bot]
2026-03-23 10:27:14 +00:00
parent bcbef88803
commit 9f8f63ec17
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/requirements.txt
+1 -1
View File
@@ -14,7 +14,7 @@ asyncpg==0.29.0
python-jose[cryptography]==3.3.0
passlib[bcrypt]==1.7.4
python-multipart==0.0.22 # Updated: Fixed multiple vulnerabilities (was 0.0.6)
authlib==1.6.6 # Updated: Fixed algorithm confusion and DoS vulnerabilities (was 1.3.0)
authlib==1.6.9 # Updated: Fixed OIDC hash binding, JWE RSA1_5 padding oracle, alg:none bypass, JWK header injection (was 1.6.6)
httpx==0.26.0
# Payment Processing