Skip to content

LCORE-1881: Fixes CVE in authlib #1536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tisnik merged 1 commit into from
Apr 19, 2026
Merged

LCORE-1881: Fixes CVE in authlib #1536

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions requirements-build.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@ setuptools==82.0.1
# googleapis-common-protos
# greenlet
# grpc-google-iam-v1
# joserfc
# llama-stack
# llama-stack-api
# markupsafe
Expand Down
9 changes: 6 additions & 3 deletions requirements.hashes.source.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,9 +132,9 @@ aiohttp==3.13.5 \
attrs==26.1.0 \
--hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \
--hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32
authlib==1.6.9 \
--hash=sha256:d8f2421e7e5980cc1ddb4e32d3f5fa659cfaf60d8eaf3281ebed192e4ab74f04 \
--hash=sha256:f08b4c14e08f0861dc18a32357b33fbcfd2ea86cfe3fe149484b4d764c4a0ac3
authlib==1.7.0 \
--hash=sha256:b3e326c9aa9cc3ea95fe7d89fd880722d3608da4d00e8a27e061e64b48d801d5 \
--hash=sha256:e36817afb02f6f0b6bf55f150782499ddd6ddf44b402bb055d3263cc65ac9ae0
Comment on lines +135 to +137

@coderabbitai coderabbitai Bot Apr 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Read-only inventory of authlib usage locations to validate against 1.7.0 docs/changelog.
set -euo pipefail

rg -n -C2 'from authlib|import authlib|jwt\.decode\(|claims\.validate\(|JsonWebToken|JsonWebKey|KeySet|BadSignatureError|DecodeError|ExpiredTokenError|JoseError' \
  src tests

Repository: lightspeed-core/lightspeed-stack

Length of output: 19487

🌐 Web query:

Authlib 1.7.0 release notes/changelog: did authlib.jose error classes (BadSignatureError, DecodeError, ExpiredTokenError, JoseError) or jwt.decode/claims validation behavior change versus 1.6.x?

💡 Result:

Yes, there are changes in Authlib 1.7.0 versus 1.6.x for authlib.jose error classes and jwt.decode/claims validation behavior. The primary change is migration to joserfc: authlib.jose is deprecated and affected modules (including JWT handling in oauth2/oidc) now use joserfc, raising joserfc-based exceptions instead of authlib.jose.errors. Error classes like BadSignatureError, DecodeError, ExpiredTokenError, JoseError exist in both, but users catching authlib.jose errors must update to import from joserfc.errors. joserfc has additional errors (e.g. ClaimError, InvalidClaimError) and recent changes like ExpiredTokenError inheriting from ClaimError (joserfc 1.6.1). jwt.decode behavior changes: in authlib.jose, it handles decoding and optional claims validation; in joserfc, decoding and claims validation are separate steps using JWTClaimsRegistry, requiring explicit validation. Changelog mentions "joserfc migration" with breaking changes in exceptions; no other jose/JWT-specific changes listed. GitHub tags/releases show up to v1.6.9 (Mar 2026), but docs confirm v1.7.0 released Apr 18, 2026.

Citations:

Authlib 1.7.0 introduces breaking changes and will break existing code.

Authlib 1.7.0 migrates from authlib.jose to joserfc with deprecated and incompatible APIs. The current code at src/authentication/jwk_token.py imports from authlib.jose and uses jwt.decode()/claims.validate() with exception handling for authlib.jose.errors classes—all of which have changed in 1.7.0.

Update required before merge:

  • Replace authlib.jose imports with joserfc equivalents
  • jwt.decode() now returns decoded claims without validation; call claims registry validation separately
  • Update exception imports to use joserfc.errors instead of authlib.jose.errors
  • Update exception handling to match joserfc error class behavior
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@requirements.hashes.source.txt` around lines 135 - 137, The project pins
authlib==1.7.0 which changed APIs; update src/authentication/jwk_token.py to
import from joserfc instead of authlib.jose, replace authlib.jose.jwt.decode()
usage with the joserfc jwt.decode equivalent that returns decoded claims without
auto-validation, then call the claims registry validation (e.g.,
ClaimsRegistry.validate or the claims.validate() pattern provided by joserfc)
explicitly after decoding; also swap exception imports from authlib.jose.errors
to joserfc.errors and adjust the except blocks to catch the joserfc error
classes (replace any authlib.jose.errors.* identifiers referenced in functions
like validate_token, decode_token, or wherever jwt.decode()/claims.validate()
are used). Ensure all references to authlib.jose.* are removed and the new
joserfc-based decode + explicit claims validation flow and error types are used
consistently.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify all authlib constraints across dependency entry points.
set -euo pipefail

fd -HI '(^pyproject\.toml$|^requirements(\.source|\.hashes\.source)?\.txt$)' \
  | xargs -r rg -n --no-heading '\bauthlib\b'

Repository: lightspeed-core/lightspeed-stack

Length of output: 167

🏁 Script executed:

# Find files that import or use authlib
rg -l 'authlib' --type py

Repository: lightspeed-core/lightspeed-stack

Length of output: 151

🏁 Script executed:

cat -n src/authentication/jwk_token.py

Repository: lightspeed-core/lightspeed-stack

Length of output: 12414

🏁 Script executed:

cat -n tests/unit/authentication/test_jwk_token.py

Repository: lightspeed-core/lightspeed-stack

Length of output: 37194

🌐 Web query:

authlib 1.7.0 changelog release notes breaking changes

💡 Result:

Authlib 1.7.0 was released on April 18, 2026. Here is a summary of the changelog, release notes, and breaking changes from the official documentation. ## Key Features and Changes: - Add support for OpenID Connect RP-Initiated Logout 1.0. - Per RFC 6749 Section 3.3, the scope parameter is now optional at both authorization and token endpoints. client.get_allowed_scope is called to determine the default scope when omitted (issue #845). - Stop support for Python 3.9, add support for Python 3.14 (pull request #850). - Allow AuthorizationServerMetadata.validate to compose with RFC extension classes. - Fix expires_at=0 being incorrectly treated as None (issue #530). - Allow ResourceProtector decorator to be used without parentheses (issue #604). - Set User-Agent header when fetching server metadata and JWKs (issue #704). - RFC7523 accepts the issuer URL as a valid audience (issue #730). - Upgrade Guide: joserfc migration (pull request #872). ## Breaking Changes: The primary breaking change is the migration to joserfc for JOSE modules (authlib.jose is deprecated). See https://docs.authlib.org/en/v1.7.0/upgrades/jose.html for details: - Affected modules: authlib.oauth2.rfc7523, rfc7591, rfc7592, rfc9068, rfc9101, authlib.oidc.core. - Exceptions now use joserfc-based errors (e.g., from joserfc.errors import JoseError). - JWTAuthenticationRequest uses only recommended JWT algorithms by default. - UserInfoEndpoint signing algorithms limited to recommended JWT algorithms. - Deprecation warnings for key imports; use explicit key types (OctKey, RSAKey, etc.). - get_jwt_config split into resolve_client_private_key, get_client_claims, etc. No specific GitHub release notes for v1.7.0 were found in search results (latest visible tags up to v1.6.9 on March 2, 2026), but official docs confirm the release.

Citations:

🌐 Web query:

authlib 1.7.0 authlib.jose removed deprecated compatibility

💡 Result:

In Authlib version 1.7.0, released on April 18, 2026, the authlib.jose module is deprecated (not removed) and emits deprecation warnings when used. It has not been removed; instead, Authlib now favors the separate joserfc library for JOSE operations (JWS, JWE, JWK, JWT). Several OAuth2 and OIDC modules now internally use joserfc, leading to breaking changes like different exceptions (now joserfc-based) and API adjustments (e.g., get_jwt_config split into resolve_client_private_key, get_client_claims, get_client_algorithm). Deprecated compatibility code or shims for the old authlib.jose were not explicitly removed based on available changelogs, but the module itself is marked for future removal with a migration guide provided. Users are recommended to migrate to joserfc directly for new code and update exception handling and key imports for compatibility.

Citations:

🌐 Web query:

authlib 1.7.0 authlib.jose.errors exception classes joserfc migration

💡 Result:

In Authlib 1.7.0, the authlib.jose module has been deprecated in favor of the separate joserfc library for JOSE (JWS, JWE, JWK, JWT) functionality. This affects modules like authlib.oauth2.rfc7523, rfc7591, rfc7592, rfc9068, rfc9101, and authlib.oidc.core, which now use joserfc internally. Key migration points for authlib.jose.errors: - Update exception imports and catches from authlib.jose.errors to joserfc.errors, as affected modules raise joserfc-based exceptions. - Example: Replace from authlib.jose.errors import JoseError with from joserfc.errors import JoseError. joserfc.errors exception classes (all subclass joserfc.errors.JoseError, the base class): - BadSignatureError: Raised for JWS when signature does not match (error: 'bad_signature'). - ClaimError: Base for JWT claims validation. - ConflictAlgorithmError (error: 'conflict_algorithm'). - DecodeError. - InvalidPayloadError (error: 'invalid_payload'). - InvalidTokenError: Alias of InvalidClaimError. - KeyParameterError (error: 'key_parameter'). - MissingAlgorithmError: Missing 'alg' in header. - MissingClaimError: Missing specific claim. - MissingCritHeaderError: Missing critical header. - MissingKeyError (error: 'missing_key'). - MissingKeyTypeError (error: 'missing_key_type'). - SecurityWarning: Base for security warnings. - UnsupportedAlgorithmError: Unsupported alg in registry (error: 'unsupported_algorithm'). - UnsupportedHeaderError (error: 'unsupported_header'). - UnsupportedKeyAlgorithmError. Legacy authlib.jose.errors (pre-migration, still in source but deprecated) include similar names like JoseError, DecodeError, MissingAlgorithmError, UnsupportedAlgorithmError, BadSignatureError, InvalidClaimError, MissingClaimError, ExpiredTokenError, InvalidTokenError, etc. For full migration details: - Authlib docs: https://docs.authlib.org/en/v1.7.0/upgrades/jose.html (breaking changes on exceptions). - joserfc errors: https://jose.authlib.org/en/api/errors/. - joserfc migration from Authlib: https://jose.authlib.org/en/migrations/authlib. - GitHub issue #766 (milestone v1.7): authlib/authlib#766 (completed Jan 2026). Additionally, get_jwt_config is split into resolve_client_private_key, get_client_claims, get_client_algorithm. Keys must be explicit JWK types (e.g., OctKey.import_key(secret)) instead of raw strings/bytes to avoid deprecation warnings. See detailed examples in docs.

Citations:

🌐 Web query:

authlib 1.7.0 CVE security fix vulnerability

💡 Result:

No, Authlib 1.7.0 does not address a specific CVE as a security fix in that version. Authlib 1.7.0, released on 2026-04-18, includes features like support for OpenID Connect RP-Initiated Logout 1.0, optional scope parameter per RFC 6749, dropped Python 3.9 support, and a fix for CSRF vulnerability in the Starlette OAuth client when a cache is configured. However, no CVE is explicitly associated with these changes in the changelog or security advisories. Known recent CVEs fixed in earlier versions include: - CVE-2026-28498 (GHSA-m344-f55w-2m6j): OIDC ID Token hash verification fail-open, affecting <=1.6.8, patched in 1.6.9 (2026-03). - CVE-2025-68158 (GHSA-fg6f-75jq-6523): 1-click account takeover via cache-backed state CSRF, affecting <=1.6.5, patched in 1.6.5/1.6.6. Snyk reports no direct vulnerabilities for Authlib 1.7.0. All prior CVEs are fixed in versions before 1.7.0, so 1.7.0 is secure regarding known CVEs.

Citations:

Update pyproject.toml floor to authlib>=1.7.0, but be aware this version introduces breaking changes requiring code review.

While pinning to authlib==1.7.0 in requirements.hashes.source.txt is good, pyproject.toml still allows authlib>=1.6.0, which bypasses the lock in non-hash install paths. However, the upgrade from 1.6.9 to 1.7.0 is not a simple CVE patch—it deprecates the authlib.jose module in favor of joserfc.

Your codebase directly imports from the deprecated authlib.jose module (JsonWebKey, JsonWebToken, error classes like BadSignatureError, DecodeError, ExpiredTokenError). In 1.7.0, exception handling may break because affected modules now raise joserfc-based exceptions instead of authlib.jose.errors. The authlib.jose module is not removed yet but is marked for deprecation with warnings.

Before updating the floor to authlib>=1.7.0, verify:

  • Whether the exception imports/handling in src/authentication/jwk_token.py work with 1.7.0's joserfc integration, or
  • Whether a full migration to joserfc should be considered instead.
Proposed follow-up 
# pyproject.toml
- "authlib>=1.6.0",
+ "authlib>=1.7.0",

Run tests with 1.7.0 to verify exception handling and API compatibility.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@requirements.hashes.source.txt` around lines 135 - 137, Update the authlib
floor in pyproject.toml to "authlib>=1.7.0" to match
requirements.hashes.source.txt, but first audit and adjust imports/usages in
src/authentication/jwk_token.py: locate uses of JsonWebKey, JsonWebToken and
exception classes (BadSignatureError, DecodeError, ExpiredTokenError) and verify
they still behave under authlib 1.7.0's joserfc integration; if the authlib.jose
module now raises joserfc exceptions, either import and handle the corresponding
joserfc exceptions or migrate the token handling code to use joserfc APIs
instead, then run the test suite under authlib==1.7.0 to confirm exception
handling and API compatibility before merging the pyproject.toml change.

@tisnik tisnik Apr 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai create issue

@coderabbitai coderabbitai Bot Apr 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

@tisnik, I've created a GitHub issue to track the follow-up work required after the authlib 1.7.0 upgrade. The issue captures:

  1. Migration of authlib.jose usages in src/authentication/jwk_token.py to joserfc (or updating exception handling to use joserfc.errors)
  2. Updating pyproject.toml floor from authlib>=1.6.0 to authlib>=1.7.0
  3. Links to the official migration guides and this PR/comment for context

The issue has been assigned to you. I'll share the issue URL once the script completes.

🏁 Script executed:

#!/bin/bash
gh issue create \
  --repo lightspeed-core/lightspeed-stack \
  --title "LCORE-1881 follow-up: Migrate authlib.jose usages to joserfc after authlib 1.7.0 upgrade" \
  --body "## Background

PR `#1536` upgrades \`authlib\` from \`1.6.9\` to \`1.7.0\` to address a CVE. However, \`authlib 1.7.0\` introduces breaking changes that require follow-up work.

**Requested by:** `@tisnik`
**Related PR:** https://github.com/lightspeed-core/lightspeed-stack/pull/1536
**Related comment:** https://github.com/lightspeed-core/lightspeed-stack/pull/1536#discussion_r3107228231

## Problem

\`authlib 1.7.0\` deprecates the \`authlib.jose\` module in favor of the standalone \`joserfc\` library. Several OAuth2/OIDC modules now internally use \`joserfc\`, causing breaking changes in exception handling.

The current codebase in \`src/authentication/jwk_token.py\` directly imports from the deprecated \`authlib.jose\` module:
- \`JsonWebKey\`, \`JsonWebToken\` from \`authlib.jose\`
- Exception classes: \`BadSignatureError\`, \`DecodeError\`, \`ExpiredTokenError\`, etc. from \`authlib.jose.errors\`

In \`authlib 1.7.0\`, affected modules now raise \`joserfc\`-based exceptions instead of \`authlib.jose.errors\`, which may cause silent failures or unhandled exceptions.

## Tasks

- [ ] Audit \`src/authentication/jwk_token.py\` for all \`authlib.jose\` imports and usages
- [ ] Verify exception handling still works correctly under \`authlib 1.7.0\`'s joserfc integration (run tests with the new version)
- [ ] Either:
  - Update exception imports to use \`joserfc.errors\` equivalents (e.g., replace \`from authlib.jose.errors import JoseError\` with \`from joserfc.errors import JoseError\`), **or**
  - Migrate token handling code fully to use \`joserfc\` APIs directly
- [ ] Update \`pyproject.toml\` floor from \`authlib>=1.6.0\` to \`authlib>=1.7.0\` to match the pinned version in \`requirements.hashes.source.txt\`
- [ ] Update/add tests to cover joserfc error class behavior

## References

- [authlib 1.7.0 changelog](https://docs.authlib.org/en/v1.7.0/upgrades/changelog.html)
- [authlib.jose migration guide](https://docs.authlib.org/en/v1.7.0/upgrades/jose.html)
- [joserfc migration from authlib](https://jose.authlib.org/en/migrations/authlib)
- [joserfc error classes](https://jose.authlib.org/en/api/errors/)
" \
  --assignee tisnik

Length of output: 63

@tisnik, the follow-up issue has been created and assigned to you:

LCORE-1881 follow-up: Migrate authlib.jose usages to joserfc after authlib 1.7.0 upgrade

The issue tracks:

  • Auditing and updating src/authentication/jwk_token.py to handle joserfc-based exceptions from authlib 1.7.0
  • Updating the pyproject.toml floor to authlib>=1.7.0
  • Adding/updating tests for the new error class behavior

autoevals==0.2.0 \
--hash=sha256:83546e86f716d5bea64de39db2e99f5eaeadd70d3f72481a75b576bc511e21d6 \
--hash=sha256:dec041989ce85d6043ba30efa959527c213a62f768dc54e77d41364510e1acb6
Expand Down Expand Up @@ -500,6 +500,9 @@ grpc-google-iam-v1==0.14.4 \
huggingface-hub==0.36.2 \
--hash=sha256:1934304d2fb224f8afa3b87007d58501acfda9215b334eed53072dd5e815ff7a \
--hash=sha256:48f0c8eac16145dfce371e9d2d7772854a4f591bcb56c9cf548accf531d54270
joserfc==1.6.4 \
--hash=sha256:34ce5f499bfcc5e9ad4cc75077f9278ab3227b71da9aaf28f9ab705f8a560d3c \
--hash=sha256:3e4a22b509b41908989237a045e25c8308d5fd47ab96bdae2dd8057c6451003a
jsonpath-ng==1.8.0 \
--hash=sha256:54252968134b5e549ea5b872f1df1168bd7defe1a52fed5a358c194e1943ddc3 \
--hash=sha256:b8dde192f8af58d646fc031fac9c99fe4d00326afc4148f1f043c601a8cfe138
Expand Down
Loading