diff --git a/environment.yml b/environment.yml
index 62a8d68576f..98661821ff3 100644
--- a/environment.yml
+++ b/environment.yml
@@ -100,8 +100,8 @@ dependencies:
   - types-requests
   - types-setuptools
   - pip:
-      # Prerelease of the required package for integration of OAuth2
-      - Authlib >=1.0.0
+      # >=1.9.0 for CVE-2026-96760 (JWS JSON signature bypass)
+      - Authlib >=1.9.0
       - dominate
       - pyjwt
       # This is a fork of tornado with a patch to allow for configurable iostream
diff --git a/setup.cfg b/setup.cfg
index ddf7445b521..bb36d39ef4d 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -54,7 +54,7 @@ install_requires =
     rucio-clients >=34.4.2
     sqlalchemy
     typing_extensions >=4.3.0
-    Authlib >=1.0.0.a2
+    Authlib >=1.9.0
     pyjwt
     dominate
     zstandard