LCORE-1881: Fixes CVE in authlib#1536
Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 20 minutes and 38 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughUpdated the pinned Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@requirements.hashes.source.txt`:
- Around line 135-137: The project pins authlib==1.7.0 which changed APIs;
update src/authentication/jwk_token.py to import from joserfc instead of
authlib.jose, replace authlib.jose.jwt.decode() usage with the joserfc
jwt.decode equivalent that returns decoded claims without auto-validation, then
call the claims registry validation (e.g., ClaimsRegistry.validate or the
claims.validate() pattern provided by joserfc) explicitly after decoding; also
swap exception imports from authlib.jose.errors to joserfc.errors and adjust the
except blocks to catch the joserfc error classes (replace any
authlib.jose.errors.* identifiers referenced in functions like validate_token,
decode_token, or wherever jwt.decode()/claims.validate() are used). Ensure all
references to authlib.jose.* are removed and the new joserfc-based decode +
explicit claims validation flow and error types are used consistently.
- Around line 135-137: Update the authlib floor in pyproject.toml to
"authlib>=1.7.0" to match requirements.hashes.source.txt, but first audit and
adjust imports/usages in src/authentication/jwk_token.py: locate uses of
JsonWebKey, JsonWebToken and exception classes (BadSignatureError, DecodeError,
ExpiredTokenError) and verify they still behave under authlib 1.7.0's joserfc
integration; if the authlib.jose module now raises joserfc exceptions, either
import and handle the corresponding joserfc exceptions or migrate the token
handling code to use joserfc APIs instead, then run the test suite under
authlib==1.7.0 to confirm exception handling and API compatibility before
merging the pyproject.toml change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 86374747-ae33-4c58-b9c0-f86af63c8326
📒 Files selected for processing (1)
requirements.hashes.source.txt
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (19)
- GitHub Check: pydocstyle
- GitHub Check: Pyright
- GitHub Check: Pylinter
- GitHub Check: bandit
- GitHub Check: unit_tests (3.12)
- GitHub Check: build-pr
- GitHub Check: unit_tests (3.13)
- GitHub Check: radon
- GitHub Check: integration_tests (3.13)
- GitHub Check: integration_tests (3.12)
- GitHub Check: mypy
- GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-on-pull-request
- GitHub Check: E2E: library mode / ci / group 3
- GitHub Check: E2E: server mode / ci / group 3
- GitHub Check: E2E: server mode / ci / group 1
- GitHub Check: E2E: library mode / ci / group 2
- GitHub Check: E2E: server mode / ci / group 2
- GitHub Check: E2E: library mode / ci / group 1
- GitHub Check: E2E Tests for Lightspeed Evaluation job
| authlib==1.7.0 \ | ||
| --hash=sha256:b3e326c9aa9cc3ea95fe7d89fd880722d3608da4d00e8a27e061e64b48d801d5 \ | ||
| --hash=sha256:e36817afb02f6f0b6bf55f150782499ddd6ddf44b402bb055d3263cc65ac9ae0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Read-only inventory of authlib usage locations to validate against 1.7.0 docs/changelog.
set -euo pipefail
rg -n -C2 'from authlib|import authlib|jwt\.decode\(|claims\.validate\(|JsonWebToken|JsonWebKey|KeySet|BadSignatureError|DecodeError|ExpiredTokenError|JoseError' \
src testsRepository: lightspeed-core/lightspeed-stack
Length of output: 19487
🌐 Web query:
Authlib 1.7.0 release notes/changelog: did authlib.jose error classes (BadSignatureError, DecodeError, ExpiredTokenError, JoseError) or jwt.decode/claims validation behavior change versus 1.6.x?
💡 Result:
Yes, there are changes in Authlib 1.7.0 versus 1.6.x for authlib.jose error classes and jwt.decode/claims validation behavior. The primary change is migration to joserfc: authlib.jose is deprecated and affected modules (including JWT handling in oauth2/oidc) now use joserfc, raising joserfc-based exceptions instead of authlib.jose.errors. Error classes like BadSignatureError, DecodeError, ExpiredTokenError, JoseError exist in both, but users catching authlib.jose errors must update to import from joserfc.errors. joserfc has additional errors (e.g. ClaimError, InvalidClaimError) and recent changes like ExpiredTokenError inheriting from ClaimError (joserfc 1.6.1). jwt.decode behavior changes: in authlib.jose, it handles decoding and optional claims validation; in joserfc, decoding and claims validation are separate steps using JWTClaimsRegistry, requiring explicit validation. Changelog mentions "joserfc migration" with breaking changes in exceptions; no other jose/JWT-specific changes listed. GitHub tags/releases show up to v1.6.9 (Mar 2026), but docs confirm v1.7.0 released Apr 18, 2026.
Citations:
- 1: https://docs.authlib.org/en/v1.7.0/upgrades/changelog.html
- 2: https://docs.authlib.org/en/v1.7.0/upgrades/jose.html
- 3: Migration to joserfc authlib/authlib#766
- 4: https://docs.authlib.org/en/latest/upgrades/jose.html
- 5: https://jose.authlib.org/en/migrations/authlib
- 6: https://github.com/lepture/authlib/blob/main/authlib/jose/errors.py
- 7: https://jose.authlib.org/en/api/errors
- 8: https://github.com/authlib/authlib/tags
- 9: https://github.com/authlib/authlib/releases
Authlib 1.7.0 introduces breaking changes and will break existing code.
Authlib 1.7.0 migrates from authlib.jose to joserfc with deprecated and incompatible APIs. The current code at src/authentication/jwk_token.py imports from authlib.jose and uses jwt.decode()/claims.validate() with exception handling for authlib.jose.errors classes—all of which have changed in 1.7.0.
Update required before merge:
- Replace
authlib.joseimports withjoserfcequivalents jwt.decode()now returns decoded claims without validation; call claims registry validation separately- Update exception imports to use
joserfc.errorsinstead ofauthlib.jose.errors - Update exception handling to match joserfc error class behavior
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@requirements.hashes.source.txt` around lines 135 - 137, The project pins
authlib==1.7.0 which changed APIs; update src/authentication/jwk_token.py to
import from joserfc instead of authlib.jose, replace authlib.jose.jwt.decode()
usage with the joserfc jwt.decode equivalent that returns decoded claims without
auto-validation, then call the claims registry validation (e.g.,
ClaimsRegistry.validate or the claims.validate() pattern provided by joserfc)
explicitly after decoding; also swap exception imports from authlib.jose.errors
to joserfc.errors and adjust the except blocks to catch the joserfc error
classes (replace any authlib.jose.errors.* identifiers referenced in functions
like validate_token, decode_token, or wherever jwt.decode()/claims.validate()
are used). Ensure all references to authlib.jose.* are removed and the new
joserfc-based decode + explicit claims validation flow and error types are used
consistently.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all authlib constraints across dependency entry points.
set -euo pipefail
fd -HI '(^pyproject\.toml$|^requirements(\.source|\.hashes\.source)?\.txt$)' \
| xargs -r rg -n --no-heading '\bauthlib\b'Repository: lightspeed-core/lightspeed-stack
Length of output: 167
🏁 Script executed:
# Find files that import or use authlib
rg -l 'authlib' --type pyRepository: lightspeed-core/lightspeed-stack
Length of output: 151
🏁 Script executed:
cat -n src/authentication/jwk_token.pyRepository: lightspeed-core/lightspeed-stack
Length of output: 12414
🏁 Script executed:
cat -n tests/unit/authentication/test_jwk_token.pyRepository: lightspeed-core/lightspeed-stack
Length of output: 37194
🌐 Web query:
authlib 1.7.0 changelog release notes breaking changes
💡 Result:
Authlib 1.7.0 was released on April 18, 2026. Here is a summary of the changelog, release notes, and breaking changes from the official documentation. ## Key Features and Changes: - Add support for OpenID Connect RP-Initiated Logout 1.0. - Per RFC 6749 Section 3.3, the scope parameter is now optional at both authorization and token endpoints. client.get_allowed_scope is called to determine the default scope when omitted (issue #845). - Stop support for Python 3.9, add support for Python 3.14 (pull request #850). - Allow AuthorizationServerMetadata.validate to compose with RFC extension classes. - Fix expires_at=0 being incorrectly treated as None (issue #530). - Allow ResourceProtector decorator to be used without parentheses (issue #604). - Set User-Agent header when fetching server metadata and JWKs (issue #704). - RFC7523 accepts the issuer URL as a valid audience (issue #730). - Upgrade Guide: joserfc migration (pull request #872). ## Breaking Changes: The primary breaking change is the migration to joserfc for JOSE modules (authlib.jose is deprecated). See https://docs.authlib.org/en/v1.7.0/upgrades/jose.html for details: - Affected modules: authlib.oauth2.rfc7523, rfc7591, rfc7592, rfc9068, rfc9101, authlib.oidc.core. - Exceptions now use joserfc-based errors (e.g., from joserfc.errors import JoseError). - JWTAuthenticationRequest uses only recommended JWT algorithms by default. - UserInfoEndpoint signing algorithms limited to recommended JWT algorithms. - Deprecation warnings for key imports; use explicit key types (OctKey, RSAKey, etc.). - get_jwt_config split into resolve_client_private_key, get_client_claims, etc. No specific GitHub release notes for v1.7.0 were found in search results (latest visible tags up to v1.6.9 on March 2, 2026), but official docs confirm the release.
Citations:
- 1: https://docs.authlib.org/en/v1.7.0/upgrades/changelog.html
- 2: https://docs.authlib.org/en/v1.7.0/upgrades/jose.html
- 3: Migration to joserfc authlib/authlib#766
- 4: https://docs.authlib.org/en/latest/upgrades/jose.html
- 5: https://github.com/authlib/authlib/tags
🌐 Web query:
authlib 1.7.0 authlib.jose removed deprecated compatibility
💡 Result:
In Authlib version 1.7.0, released on April 18, 2026, the authlib.jose module is deprecated (not removed) and emits deprecation warnings when used. It has not been removed; instead, Authlib now favors the separate joserfc library for JOSE operations (JWS, JWE, JWK, JWT). Several OAuth2 and OIDC modules now internally use joserfc, leading to breaking changes like different exceptions (now joserfc-based) and API adjustments (e.g., get_jwt_config split into resolve_client_private_key, get_client_claims, get_client_algorithm). Deprecated compatibility code or shims for the old authlib.jose were not explicitly removed based on available changelogs, but the module itself is marked for future removal with a migration guide provided. Users are recommended to migrate to joserfc directly for new code and update exception handling and key imports for compatibility.
Citations:
- 1: https://docs.authlib.org/en/v1.7.0/upgrades/changelog.html
- 2: https://docs.authlib.org/en/v1.7.0/upgrades/jose.html
- 3: https://docs.authlib.org/en/latest/upgrades/jose.html
- 4: Migration to joserfc authlib/authlib#766
- 5: https://jose.authlib.org/en/dev/migrations/authlib/
- 6: https://github.com/authlib/authlib/releases
🌐 Web query:
authlib 1.7.0 authlib.jose.errors exception classes joserfc migration
💡 Result:
In Authlib 1.7.0, the authlib.jose module has been deprecated in favor of the separate joserfc library for JOSE (JWS, JWE, JWK, JWT) functionality. This affects modules like authlib.oauth2.rfc7523, rfc7591, rfc7592, rfc9068, rfc9101, and authlib.oidc.core, which now use joserfc internally. Key migration points for authlib.jose.errors: - Update exception imports and catches from authlib.jose.errors to joserfc.errors, as affected modules raise joserfc-based exceptions. - Example: Replace from authlib.jose.errors import JoseError with from joserfc.errors import JoseError. joserfc.errors exception classes (all subclass joserfc.errors.JoseError, the base class): - BadSignatureError: Raised for JWS when signature does not match (error: 'bad_signature'). - ClaimError: Base for JWT claims validation. - ConflictAlgorithmError (error: 'conflict_algorithm'). - DecodeError. - InvalidPayloadError (error: 'invalid_payload'). - InvalidTokenError: Alias of InvalidClaimError. - KeyParameterError (error: 'key_parameter'). - MissingAlgorithmError: Missing 'alg' in header. - MissingClaimError: Missing specific claim. - MissingCritHeaderError: Missing critical header. - MissingKeyError (error: 'missing_key'). - MissingKeyTypeError (error: 'missing_key_type'). - SecurityWarning: Base for security warnings. - UnsupportedAlgorithmError: Unsupported alg in registry (error: 'unsupported_algorithm'). - UnsupportedHeaderError (error: 'unsupported_header'). - UnsupportedKeyAlgorithmError. Legacy authlib.jose.errors (pre-migration, still in source but deprecated) include similar names like JoseError, DecodeError, MissingAlgorithmError, UnsupportedAlgorithmError, BadSignatureError, InvalidClaimError, MissingClaimError, ExpiredTokenError, InvalidTokenError, etc. For full migration details: - Authlib docs: https://docs.authlib.org/en/v1.7.0/upgrades/jose.html (breaking changes on exceptions). - joserfc errors: https://jose.authlib.org/en/api/errors/. - joserfc migration from Authlib: https://jose.authlib.org/en/migrations/authlib. - GitHub issue #766 (milestone v1.7): authlib/authlib#766 (completed Jan 2026). Additionally, get_jwt_config is split into resolve_client_private_key, get_client_claims, get_client_algorithm. Keys must be explicit JWK types (e.g., OctKey.import_key(secret)) instead of raw strings/bytes to avoid deprecation warnings. See detailed examples in docs.
Citations:
- 1: https://docs.authlib.org/en/v1.7.0/upgrades/jose.html
- 2: https://jose.authlib.org/en/dev/api/errors/
- 3: https://jose.authlib.org/en/api/errors/
- 4: https://github.com/lepture/authlib/blob/main/authlib/jose/errors.py
- 5: Migration to joserfc authlib/authlib#766
- 6: https://docs.authlib.org/en/latest/upgrades/jose.html
- 7: https://jose.authlib.org/en/migrations/authlib
🌐 Web query:
authlib 1.7.0 CVE security fix vulnerability
💡 Result:
No, Authlib 1.7.0 does not address a specific CVE as a security fix in that version. Authlib 1.7.0, released on 2026-04-18, includes features like support for OpenID Connect RP-Initiated Logout 1.0, optional scope parameter per RFC 6749, dropped Python 3.9 support, and a fix for CSRF vulnerability in the Starlette OAuth client when a cache is configured. However, no CVE is explicitly associated with these changes in the changelog or security advisories. Known recent CVEs fixed in earlier versions include: - CVE-2026-28498 (GHSA-m344-f55w-2m6j): OIDC ID Token hash verification fail-open, affecting <=1.6.8, patched in 1.6.9 (2026-03). - CVE-2025-68158 (GHSA-fg6f-75jq-6523): 1-click account takeover via cache-backed state CSRF, affecting <=1.6.5, patched in 1.6.5/1.6.6. Snyk reports no direct vulnerabilities for Authlib 1.7.0. All prior CVEs are fixed in versions before 1.7.0, so 1.7.0 is secure regarding known CVEs.
Citations:
- 1: https://docs.authlib.org/en/v1.7.0/community/security.html
- 2: https://docs.authlib.org/en/v1.7.0/upgrades/changelog.html
- 3: https://security.snyk.io/package/pip/Authlib/1.7.0
- 4: https://github.com/authlib/authlib/releases
- 5: GHSA-m344-f55w-2m6j
- 6: https://pypi.org/project/Authlib/1.6.7/
- 7: https://pypi.org/project/Authlib/
Update pyproject.toml floor to authlib>=1.7.0, but be aware this version introduces breaking changes requiring code review.
While pinning to authlib==1.7.0 in requirements.hashes.source.txt is good, pyproject.toml still allows authlib>=1.6.0, which bypasses the lock in non-hash install paths. However, the upgrade from 1.6.9 to 1.7.0 is not a simple CVE patch—it deprecates the authlib.jose module in favor of joserfc.
Your codebase directly imports from the deprecated authlib.jose module (JsonWebKey, JsonWebToken, error classes like BadSignatureError, DecodeError, ExpiredTokenError). In 1.7.0, exception handling may break because affected modules now raise joserfc-based exceptions instead of authlib.jose.errors. The authlib.jose module is not removed yet but is marked for deprecation with warnings.
Before updating the floor to authlib>=1.7.0, verify:
- Whether the exception imports/handling in
src/authentication/jwk_token.pywork with 1.7.0's joserfc integration, or - Whether a full migration to joserfc should be considered instead.
Proposed follow-up
# pyproject.toml
- "authlib>=1.6.0",
+ "authlib>=1.7.0",Run tests with 1.7.0 to verify exception handling and API compatibility.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@requirements.hashes.source.txt` around lines 135 - 137, Update the authlib
floor in pyproject.toml to "authlib>=1.7.0" to match
requirements.hashes.source.txt, but first audit and adjust imports/usages in
src/authentication/jwk_token.py: locate uses of JsonWebKey, JsonWebToken and
exception classes (BadSignatureError, DecodeError, ExpiredTokenError) and verify
they still behave under authlib 1.7.0's joserfc integration; if the authlib.jose
module now raises joserfc exceptions, either import and handle the corresponding
joserfc exceptions or migrate the token handling code to use joserfc APIs
instead, then run the test suite under authlib==1.7.0 to confirm exception
handling and API compatibility before merging the pyproject.toml change.
There was a problem hiding this comment.
🧩 Analysis chain
@tisnik, I've created a GitHub issue to track the follow-up work required after the authlib 1.7.0 upgrade. The issue captures:
- Migration of
authlib.joseusages insrc/authentication/jwk_token.pytojoserfc(or updating exception handling to usejoserfc.errors) - Updating
pyproject.tomlfloor fromauthlib>=1.6.0toauthlib>=1.7.0 - Links to the official migration guides and this PR/comment for context
The issue has been assigned to you. I'll share the issue URL once the script completes.
🏁 Script executed:
#!/bin/bash
gh issue create \
--repo lightspeed-core/lightspeed-stack \
--title "LCORE-1881 follow-up: Migrate authlib.jose usages to joserfc after authlib 1.7.0 upgrade" \
--body "## Background
PR `#1536` upgrades \`authlib\` from \`1.6.9\` to \`1.7.0\` to address a CVE. However, \`authlib 1.7.0\` introduces breaking changes that require follow-up work.
**Requested by:** `@tisnik`
**Related PR:** https://github.com/lightspeed-core/lightspeed-stack/pull/1536
**Related comment:** https://github.com/lightspeed-core/lightspeed-stack/pull/1536#discussion_r3107228231
## Problem
\`authlib 1.7.0\` deprecates the \`authlib.jose\` module in favor of the standalone \`joserfc\` library. Several OAuth2/OIDC modules now internally use \`joserfc\`, causing breaking changes in exception handling.
The current codebase in \`src/authentication/jwk_token.py\` directly imports from the deprecated \`authlib.jose\` module:
- \`JsonWebKey\`, \`JsonWebToken\` from \`authlib.jose\`
- Exception classes: \`BadSignatureError\`, \`DecodeError\`, \`ExpiredTokenError\`, etc. from \`authlib.jose.errors\`
In \`authlib 1.7.0\`, affected modules now raise \`joserfc\`-based exceptions instead of \`authlib.jose.errors\`, which may cause silent failures or unhandled exceptions.
## Tasks
- [ ] Audit \`src/authentication/jwk_token.py\` for all \`authlib.jose\` imports and usages
- [ ] Verify exception handling still works correctly under \`authlib 1.7.0\`'s joserfc integration (run tests with the new version)
- [ ] Either:
- Update exception imports to use \`joserfc.errors\` equivalents (e.g., replace \`from authlib.jose.errors import JoseError\` with \`from joserfc.errors import JoseError\`), **or**
- Migrate token handling code fully to use \`joserfc\` APIs directly
- [ ] Update \`pyproject.toml\` floor from \`authlib>=1.6.0\` to \`authlib>=1.7.0\` to match the pinned version in \`requirements.hashes.source.txt\`
- [ ] Update/add tests to cover joserfc error class behavior
## References
- [authlib 1.7.0 changelog](https://docs.authlib.org/en/v1.7.0/upgrades/changelog.html)
- [authlib.jose migration guide](https://docs.authlib.org/en/v1.7.0/upgrades/jose.html)
- [joserfc migration from authlib](https://jose.authlib.org/en/migrations/authlib)
- [joserfc error classes](https://jose.authlib.org/en/api/errors/)
" \
--assignee tisnik
Length of output: 63
@tisnik, the follow-up issue has been created and assigned to you:
LCORE-1881 follow-up: Migrate authlib.jose usages to joserfc after authlib 1.7.0 upgrade
The issue tracks:
- Auditing and updating
src/authentication/jwk_token.pyto handlejoserfc-based exceptions fromauthlib 1.7.0 - Updating the
pyproject.tomlfloor toauthlib>=1.7.0 - Adding/updating tests for the new error class behavior
tisnik
force-pushed
the
lcore-1881-fixes-cve-in-authlib
branch
from
029030e to
8ff95bf
Compare
1 participant
Description
LCORE-1881: Fixes CVE in authlib
Type of change
Tools used to create PR
Related Tickets & Documents
Summary by CodeRabbit