Read the docs
TI-2026-28981 Aliases CVE-2026-40166

authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-863.

Summary

authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/access_tokens/. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed authentik (goauthentik): 2025.12.5, 2026.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
goauthentikauthentikbefore 2025.12.5; 2026.2.0-rc1 to before 2026.2.32025.12.5, 2026.2.3Patch availableCNA
  • authentik Vendorgoauthentik Affected before 2025.12.5; 2026.2.0-rc1 to before 2026.2.3 Fixed in 2025.12.5, 2026.2.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*——goauthentik
  • cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:* Versions — — ·goauthentik

Remediation

  • Fix · CNA authentik (goauthentik) Fixed in 2025.12.5, 2026.2.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40166

References

Other 3

  • TI-2026-36603 authentik: SourceStage bypass via empty POST CVSS 3.1CRITICAL 9.8
  • TI-2022-07608 authentik vulnerable to Improper Authentication via invitation URL token reuse CVSS 3.1CRITICAL 9.4
  • TI-2026-36598 authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API CVSS 3.1HIGH 8.8
  • TI-2022-22816 authentik allows existing authenticated users to create arbitrary accounts CVSS 3.1MEDIUM 6.4
  • TI-2026-41431 authentik: Account Takeover via SAML NameID Comment Truncation CVSS 4.0CRITICAL 9.4
  • TI-2024-25628 Insufficient access control for OAuth2 Device Code flow in authentik CVSS 3.1CRITICAL 9.8
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences