GeezerVison

Version 1.9.5 — 2026-11-05

--------------------------

Security
~~~~~~~~

- ``authlib.jose`` refuses as an HMAC secret every OpenSSH public key or
  certificate that it can load as an RSA, EC or OKP key. It used to accept a
  key with a tab after the key type, and certificates. These keys verify
  ``RS256`` and ``EdDSA`` tokens, so anyone who knew the public key could
  forge an ``HS256`` token for an application that did not restrict the
  algorithms. This completes the fix for CVE-2026-114615.
  `GHSA-f7j6-p4qx-gq99 <https://github.com/authlib/authlib/security/advisories/GHSA-f7j6-p4qx-gq99>`_

Version 1.9.4 — 2026-11-04

--------------------------

Security
~~~~~~~~

- ``IDJAGGrant`` stores the verified claims of the ID-JAG in
  ``request.id_jag_claims``. ``authenticate_user`` can use them to resolve
  the user with the ``iss`` and ``sub`` claims, and ``tenant`` for a
  multi-tenant IdP. The documentation used to resolve the user with ``sub``
  alone. An IdP, or a tenant of an IdP, could then get access tokens for the
  users of another one. Update ``authenticate_user`` if your server trusts
  several IdPs or a multi-tenant IdP.
  `GHSA-9qr6-8289-9j56 <https://github.com/authlib/authlib/security/advisories/GHSA-9qr6-8289-9j56>`_

Version 1.9.3 — 2026-11-03

--------------------------

Security
~~~~~~~~

- The OpenID Connect implicit and hybrid grants refuse ``response_mode=form_post``
  when the redirect URI does not use the ``http`` or ``https`` scheme. They
  return an ``invalid_request`` error and do not redirect. A client with a
  ``javascript:`` redirect URI could run a script in the origin of the
  authorization server, even when the user denied the authorization.
  `GHSA-gp2m-377p-m4j3 <https://github.com/authlib/authlib/security/advisories/GHSA-gp2m-377p-m4j3>`_

Version 1.9.2 — 2026-11-01

--------------------------

Security
~~~~~~~~

- ``IDJAGGrant`` limits the access token to the scopes in the ``scope`` claim
  of the ID-JAG. A client used to get any scope allowed by its registration,
  even when the IdP granted fewer scopes. Without a ``scope`` request
  parameter, the access token now gets the scopes of the claim instead of no
  scope.
  `GHSA-f3fg-34g9-v7jx <https://github.com/authlib/authlib/security/advisories/GHSA-f3fg-34g9-v7jx>`_

Version 1.9.1 — 2026-10-14

--------------------------

Breaking changes
~~~~~~~~~~~~~~~~

- The RFC 7592 client configuration endpoint calls ``check_client()`` on the
  registration access token. Tokens must implement
  ``TokenMixin.check_client``.

Security
~~~~~~~~

- ``authlib.jose`` rejects empty HMAC keys with a ``ValueError``. An empty key
  used to let anyone forge HS256, HS384 and HS512 signatures. The minimum
  ``joserfc`` version is now 1.6.8, which has the same check.
  `GHSA-8m4g-j4wp-wgcg <https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg>`_
- The RFC 7592 client configuration endpoint rejects registration access
  tokens issued to another client, with an ``access_denied`` error. A client
  could read, update or delete the registration of any other client.
  `GHSA-c73q-w75p-j82v <https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v>`_

chore: release 1.9.0

chore: release 1.8.0

Version 1.7.2

-------------

**Released on May 6, 2026**

- Fix ``PrivateKeyJWT`` rejecting ``ECKey`` private keys (e.g. for ``ES256``).
  The client private key is no longer forcibly imported as an ``RSAKey``;
  ``joserfc``'s key auto-detection is used instead. :pr:`852`
- Allow ``ClientSecretJWT`` and ``PrivateKeyJWT`` to sign client assertions
  with non-recommended algorithms (e.g. ``RS384``) when explicitly set via the
  ``alg`` parameter. :issue:`883`
- Validate BCP 47 language tags in ``ui_locales_supported``, ``claims_locales_supported``
  and ``UserInfo.locale``. :pr:`873`

Version 1.7.1

-------------

**Released on may 4, 2026**

- Fix ``AuthlibDeprecationWarning`` being emitted on import when using integrations
  that do not use ``authlib.jose`` directly. :issue:`880`
- Fix redirecting to unvalidated ``redirect_uri`` on ``InvalidScopeError``
  in ``OpenIDImplicitGrant`` and ``OpenIDHybridGrant``.

Version 1.7.1

-------------

**Released on may 4, 2026**

- Fix ``AuthlibDeprecationWarning`` being emitted on import when using integrations
  that do not use ``authlib.jose`` directly. :issue:`880`
- Fix redirecting to unvalidated ``redirect_uri`` on ``InvalidScopeError``
  in ``OpenIDImplicitGrant`` and ``OpenIDHybridGrant``.