From 565dc5f71059f3d13f5cea7d5dde59fed0778a09 Mon Sep 17 00:00:00 2001
From: twothatIT <s.lustenberger@x26.ch>
Date: Tue, 20 Oct 2026 08:47:33 +0200
Subject: [PATCH] fix(auth): replace unmaintained python-jose with PyJWT

Dependabot alert #25 (python-jose algorithm confusion guard bypassed by
DER-encoded public keys, CVE-2026-85394, Critical) has no patched version
of python-jose available at all - it's affected through the latest
release 3.5.0. python-jose was only used in app/dependencies.py for plain
HS256 JWT encode/decode with our own symmetric SECRET_KEY (algorithms=[...]
was already explicitly restricted on every decode call, so the specific
RS256/HS256 confusion path didn't apply here), but staying on an
unmaintained library that keeps generating unfixable critical alerts isn't
sustainable.

Swapped to PyJWT, which is actively maintained, already pulled in
transitively via msal, and a near drop-in replacement for this app's
encode()/decode() usage. Verified with a Docker build and in-container
token create/verify/reject round-trip.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 app/dependencies.py | 7 ++++---
 requirements.txt    | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/app/dependencies.py b/app/dependencies.py
index c2d754c..4da0022 100644
--- a/app/dependencies.py
+++ b/app/dependencies.py
@@ -3,9 +3,10 @@
 from datetime import datetime, timedelta
 from typing import Optional
 
+import jwt
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
-from jose import JWTError, jwt
+from jwt import PyJWTError
 from sqlalchemy.orm import Session
 
 from app.database import get_db
@@ -56,7 +57,7 @@ def verify_mfa_token(token: str) -> str:
                 detail="Invalid MFA token.",
             )
         return username
-    except JWTError:
+    except PyJWTError:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="MFA token expired or invalid.",
@@ -95,7 +96,7 @@ def get_current_user(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail="Invalid token payload.",
             )
-    except JWTError:
+    except PyJWTError:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid or expired token.",
diff --git a/requirements.txt b/requirements.txt
index b9b45f8..6f4cd64 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -5,7 +5,7 @@ sqlalchemy==2.0.23
 aiosqlite==0.19.0
 pydantic==2.5.2
 pydantic-settings==2.1.0
-python-jose[cryptography]==3.4.0
+PyJWT==2.15.1
 passlib[bcrypt]==1.7.4
 bcrypt==4.1.2
 cryptography==50.0.0