CVE-2026-40166: authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the clientsecret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/accesstokens/. The API response includes a nested provider object containing clientid and clientsecret for providers configured with clienttype: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
authentikto a version that resolves this vulnerability.Fixed in 2025.12.5 - Upgrade
Upgrade
authentikto a version that resolves this vulnerability.Fixed in 2026.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40166?
CVE-2026-40166 has a risk score of 47, indicating a moderate level of severity.
How do I fix CVE-2026-40166?
To fix CVE-2026-40166, upgrade to Authentik version 2025.12.5 or 2026.2.3 or newer.
What type of vulnerability is CVE-2026-40166?
CVE-2026-40166 is classified as an information leakage vulnerability.
Who is affected by CVE-2026-40166?
Authenticated non-admin users of Authentik with OAuth2 access tokens are affected by CVE-2026-40166.
What can an attacker do with CVE-2026-40166?
An attacker can retrieve confidential OAuth client_secret information, potentially compromising OAuth2 providers.