# What changed in authlib

> 33 changes in authlib 1 from its official release notes, upgrade guides and advisories: 7 breaking, 10 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/authlib/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## authlib 1

### Breaking changes

- Rejects empty HMAC keys with a ValueError, preventing anyone from forging HS256, HS384 and HS512 signatures. (1.9.1) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.1)
- Tokens used for the RFC 7592 client configuration endpoint must implement TokenMixin.check_client. (1.9.1) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.1)
- Requires client authentication for ID-JAG grants. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- Enforces key, scope, and audience validation. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- Enforces nonce and JAR request validation. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- Boolean values are rejected for NumericDate claims. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- The client uses httpx2 instead of httpx. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)

### Security

- Rejects registration access tokens issued to another client with an access_denied error, preventing access to another client's registration. (1.9.1) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.1)
- Fixes validation of empty signatures during JWS JSON deserialization. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type (1.6.10, 1.7.1) — [security advisory](https://github.com/advisories/GHSA-W8P2-R796-3VMQ)
- Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect (1.6.12, 1.7.1) — [security advisory](https://github.com/advisories/GHSA-R95X-QFJJ-FJJ2)
- Authlib: Cross-site request forging when using cache (1.6.11) — [security advisory](https://github.com/advisories/GHSA-JJ8C-MMJ3-MMGV)
- Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding (1.6.9) — [security advisory](https://github.com/advisories/GHSA-M344-F55W-2M6J)
- Authlib JWS JWK Header Injection: Signature Verification Bypass (1.6.9) — [security advisory](https://github.com/advisories/GHSA-WVWJ-CVRP-7PV5)
- Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle (1.6.9) — [security advisory](https://github.com/advisories/GHSA-7432-952R-CW78)
- Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification (1.6.7) — [security advisory](https://github.com/advisories/GHSA-7WC2-QXGW-G8GG)
- Authlib has 1-click Account Takeover vulnerability (1.6.6) — [security advisory](https://github.com/advisories/GHSA-FG6F-75JQ-6523)

### New APIs and options

- Adds support for the Identity Assertion JWT Authorization Grant. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- Adds a client_id parameter. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- Leeway is configurable for JWT bearer token validation. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)

### Behavior and default changes

- Client metadata is preferred when guessing algorithms. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- Adds a default jti claim when signing a JWT bearer assertion. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)

### Fixes and other changes

- Returns None when id_token is absent, matching the sync client. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- Avoids duplicated OAuth 1.0 parameters in signed requests. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- Rate-limit responses no longer cause an uncaught JSONDecodeError; they produce a catchable error instead. (1.9.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.9.0)
- Saves the device credential with the authenticated client id. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- Fixes handling of binary form data with httpx OAuth1. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- Corrects the protocol name in the OAuth1 error description. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- The client can be flexible with JWT headers. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- Casts the sub claim to a string. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- Catches InvalidKeyIdError in the RFC 9068 validator. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- Omits claims whose value is None. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)
- Fixes handling of malformed RFC7523 claims. (1.8.0) — [release notes](https://github.com/authlib/authlib/releases/tag/v1.8.0)