pypi / authlib
authlib
What changed in authlib 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
7 breaking10 security3 new APIs and options2 behavior and defaults11 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initauthlib 133 changes
Breaking changes 7
Rejects empty HMAC keys with a ValueError, preventing anyone from forging HS256, HS384 and HS512 signatures.
Tokens used for the RFC 7592 client configuration endpoint must implement TokenMixin.check_client.
Requires client authentication for ID-JAG grants.
Enforces key, scope, and audience validation.
Enforces nonce and JAR request validation.
Boolean values are rejected for NumericDate claims.
The client uses httpx2 instead of httpx.
Security 10
Rejects registration access tokens issued to another client with an access_denied error, preventing access to another client's registration.
Fixes validation of empty signatures during JWS JSON deserialization.
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect
Authlib: Cross-site request forging when using cache
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Authlib JWS JWK Header Injection: Signature Verification Bypass
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
Authlib: Setting
alg: noneand a blank signature appears to bypass signature verificationAuthlib has 1-click Account Takeover vulnerability
New APIs and options 3
Adds support for the Identity Assertion JWT Authorization Grant.
Adds a client_id parameter.
Leeway is configurable for JWT bearer token validation.
Behavior and default changes 2
Client metadata is preferred when guessing algorithms.
Adds a default jti claim when signing a JWT bearer assertion.
Fixes and other changes 11
Returns None when id_token is absent, matching the sync client.
Avoids duplicated OAuth 1.0 parameters in signed requests.
Rate-limit responses no longer cause an uncaught JSONDecodeError; they produce a catchable error instead.
Saves the device credential with the authenticated client id.
Fixes handling of binary form data with httpx OAuth1.
Corrects the protocol name in the OAuth1 error description.
The client can be flexible with JWT headers.
Casts the sub claim to a string.
Catches InvalidKeyIdError in the RFC 9068 validator.
Omits claims whose value is None.
Fixes handling of malformed RFC7523 claims.