Information Exposure in Authentik Open-Source Identity Provider
CVE-2026-40166
What is CVE-2026-40166?
In the Authentik open-source identity provider, a flaw exists that allows authenticated non-admin users, possessing at least one OAuth2 access token, to access the client_secret of confidential OAuth2 providers. This vulnerability is associated with the logic in the API endpoint GET /api/v3/oauth2/access_tokens/, where the API response erroneously includes sensitive information such as client_id and client_secret for certain privileged providers. This access should be restricted to higher-privilege users only. The issue has been rectified in the Authentik versions 2025.12.5 and 2026.2.3, preventing unauthorized access to confidential credentials.
Affected Version(s)
authentik < 2025.12.5 < 2025.12.5
authentik >= 2026.2.0-rc1, < 2026.2.3 < 2026.2.0-rc1, 2026.2.3