diff --git a/authlib-1.6.5.tar.gz b/authlib-1.6.5.tar.gz
deleted file mode 100644
index 643b1b1..0000000
--- a/authlib-1.6.5.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:488ea98a032cb803e3af502cef6db616d76735b631097bc661b2a9dd10db73cc
-size 328496
diff --git a/authlib-1.6.6.tar.gz b/authlib-1.6.6.tar.gz
new file mode 100644
index 0000000..46556c8
--- /dev/null
+++ b/authlib-1.6.6.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0c06b18e667033c3ed5c640bcc52d1bd7d8b285c2babc3e974bbb376b0b0b1c1
+size 329249
diff --git a/python-Authlib.changes b/python-Authlib.changes
index c40fa06..77f6a39 100644
--- a/python-Authlib.changes
+++ b/python-Authlib.changes
@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Fri Jan  9 08:29:28 UTC 2026 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Update to 1.6.6 (bsc#1256414, CVE-2025-68158)
+  * ``get_jwt_config`` takes a ``client`` parameter, #844.
+  * Fix incorrect signature when ``Content-Type`` is x-www-form-urlencoded
+    for OAuth 1.0 Client, #778.
+  * Use ``expires_in`` in ``OAuth2Token`` when ``expires_at`` is unparsable, #842.
+  * Always track ``state`` in session for OAuth client integrations.
+
 -------------------------------------------------------------------
 Mon Oct 13 08:51:01 UTC 2025 - Nico Krapp <nico.krapp@suse.com>
 
diff --git a/python-Authlib.spec b/python-Authlib.spec
index 70bfa0c..e6d6cb6 100644
--- a/python-Authlib.spec
+++ b/python-Authlib.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package python-Authlib
 #
-# Copyright (c) 2025 SUSE LLC and contributors
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,7 +19,7 @@
 %define modname authlib
 %{?sle15_python_module_pythons}
 Name:           python-Authlib
-Version:        1.6.5
+Version:        1.6.6
 Release:        0
 Summary:        Python library for building OAuth and OpenID Connect servers
 License:        BSD-3-Clause