From 2f4f01c4b0dccf4d465ee0bed7c581c415d7a368 Mon Sep 17 00:00:00 2001 From: aldbr Date: Wed, 28 Oct 2026 15:27:05 +0100 Subject: [PATCH] fix: require Authlib >=1.9.0 (CVE-2026-96760) Authlib <1.9.0 accepts a JWS JSON Serialization with an empty or null "signatures" list as verified (JsonWebSignature.deserialize_json and deserialize). DIRAC only verifies compact JWS/JWTs (deserialize_compact, authlib.jose.jwt.decode), so it is not exploitable, but raise the floor so installations stop carrying the vulnerable version. Assisted-by: Claude:claude-opus-5-5 --- environment.yml | 4 ++-- setup.cfg | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/environment.yml b/environment.yml index d1dd06bc32d..5f98e0038c7 100644 --- a/environment.yml +++ b/environment.yml @@ -102,8 +102,8 @@ dependencies: - types-requests - types-setuptools - pip: - # Prerelease of the required package for integration of OAuth2 - - Authlib >=1.0.0 + # >=1.9.0 for CVE-2026-96760 (JWS JSON signature bypass) + - Authlib >=1.9.0 - dominate - pyjwt # This is a fork of tornado with a patch to allow for configurable iostream diff --git a/setup.cfg b/setup.cfg index eb9ec2cbd27..c4c82296f1d 100644 --- a/setup.cfg +++ b/setup.cfg @@ -57,7 +57,7 @@ install_requires = rucio-clients >=34.4.2 sqlalchemy typing_extensions >=4.3.0 - Authlib >=1.0.0.a2 + Authlib >=1.9.0 pyjwt dominate zstandard