CVE-2026-40166 Details
Description
authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/access_tokens/. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3.
A vulnerability in authentik, an open-source identity provider, allows authenticated non-admin users with at least one OAuth2 access token to access the client_secret of confidential OAuth2 providers they have previously authenticated with. This sensitive information is exposed through the API endpoint /api/v3/oauth2/access_tokens/. The vulnerability exists in authentik versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2.
Users can upgrade to authentik versions 2025.12.5 or 2026.2.3 to address this vulnerability. For versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, it is recommended to restrict API access to /api/v3/oauth2/access_tokens/ for non-admin users or to review and limit which users can complete OAuth2 flows with confidential providers until a patched version is applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 22, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.5 | [email protected] | Release NotesVendor |
| https://github.com/goauthentik/authentik/releases/tag/version%2F2026.2.3 | [email protected] | Release NotesVendor |
| https://github.com/goauthentik/authentik/security/advisories/GHSA-hhpc-rqgm-pxj4 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| authentik | <= 2026.2.2 (semver) <= 2025.12.4 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | New CVE Received | [email protected] |