From 4f823774ab3a91df4682213314ce560190c018c8 Mon Sep 17 00:00:00 2001
From: G30 <50341825+silentoplayz@users.noreply.github.com>
Date: Thu, 23 Jul 2026 21:54:59 -0400
Subject: [PATCH] fix: migrate deprecated authlib.jose import to joserfc in
 oauth utils (#27310)

---
 backend/open_webui/utils/oauth.py | 2 +-
 backend/requirements-min.txt      | 1 +
 backend/requirements.txt          | 1 +
 pyproject.toml                    | 1 +
 4 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py
index 0d72a24efe..63c72eeac3 100644
--- a/backend/open_webui/utils/oauth.py
+++ b/backend/open_webui/utils/oauth.py
@@ -16,7 +16,6 @@ from typing import Literal, Optional
 
 import aiohttp
 from authlib.integrations.starlette_client import OAuth
-from authlib.jose.errors import BadSignatureError
 from authlib.oauth2.rfc6749.errors import OAuth2Error
 from authlib.oidc.core import UserInfo
 from cryptography.fernet import Fernet
@@ -24,6 +23,7 @@ from fastapi import (
     HTTPException,
     status,
 )
+from joserfc.errors import BadSignatureError
 from joserfc.jws import JWSRegistry
 from joserfc.registry import HeaderParameter
 from mcp.shared.auth import (
diff --git a/backend/requirements-min.txt b/backend/requirements-min.txt
index 7ccc3f7261..39abe2ec85 100644
--- a/backend/requirements-min.txt
+++ b/backend/requirements-min.txt
@@ -14,6 +14,7 @@ bcrypt==5.0.0
 argon2-cffi==25.1.0
 PyJWT[crypto]==2.13.0
 authlib==1.7.2
+joserfc==1.7.4
 
 requests==2.34.2
 aiohttp==3.13.5 # do not update to 3.13.3 - broken
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 4a3169762f..c1fd1528b4 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -11,6 +11,7 @@ bcrypt==5.0.0
 argon2-cffi==25.1.0
 PyJWT[crypto]==2.13.0
 authlib==1.7.2
+joserfc==1.7.4
 
 requests==2.34.2
 aiohttp==3.13.5 # do not update to 3.13.3 - broken
diff --git a/pyproject.toml b/pyproject.toml
index 1944904e53..ee2fb16d67 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,6 +19,7 @@ dependencies = [
     "argon2-cffi==25.1.0",
     "PyJWT[crypto]==2.13.0",
     "authlib==1.7.2",
+    "joserfc==1.7.4",
 
     "requests==2.34.2",
     "aiohttp==3.13.5", # do not update to 3.13.3 - broken