@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.9.3"
+version = "1.9.4"
 author = "Hsiaoming Yang <[email protected]>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"
 
@@ -8,6 +8,23 @@ Here you can see the full list of changes between each Authlib release.
 
 .. scriv-insert-here
 
+.. _changelog-1.9.4:
+
+Version 1.9.4 — 2026-11-04
+--------------------------
+
+Security
+~~~~~~~~
+
+- ``IDJAGGrant`` stores the verified claims of the ID-JAG in
+  ``request.id_jag_claims``. ``authenticate_user`` can use them to resolve
+  the user with the ``iss`` and ``sub`` claims, and ``tenant`` for a
+  multi-tenant IdP. The documentation used to resolve the user with ``sub``
+  alone. An IdP, or a tenant of an IdP, could then get access tokens for the
+  users of another one. Update ``authenticate_user`` if your server trusts
+  several IdPs or a multi-tenant IdP.
+  `GHSA-9qr6-8289-9j56 <https://github.com/authlib/authlib/security/advisories/GHSA-9qr6-8289-9j56>`_
+
 .. _changelog-1.9.3:
 
 Version 1.9.3 — 2026-11-03