diff --git a/auth/end-user/web/requirements.txt b/auth/end-user/web/requirements.txt
index d63350dd214..0daad6f0198 100644
--- a/auth/end-user/web/requirements.txt
+++ b/auth/end-user/web/requirements.txt
@@ -4,3 +4,4 @@ google-auth-httplib2==0.0.3
 google-api-python-client==1.7.8
 flask==1.0.2
 requests==2.21.0
+urllib3>=2.6.0 # not directly required, pinned by Snyk to avoid a vulnerability