CVE-2026-40166: authentik Information Disclosure Flaw

CVE-2026-40166 Overview

CVE-2026-40166 is an information disclosure vulnerability in authentik, an open-source identity provider. The flaw allows authenticated non-admin users to retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against. The issue resides in the GET /api/v3/oauth2/access_tokens/ endpoint, which returns a nested provider object containing both client_id and client_secret for providers configured with client_type: confidential. The vulnerability is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Affected versions include releases prior to 2025.12.5 and the 2026.2.0-rc1 through 2026.2.2 release line.

Critical Impact
Low-privilege authenticated users can exfiltrate OAuth2 confidential client secrets, enabling impersonation of OAuth2 clients and downstream token theft against integrated applications.

Affected Products

authentik versions prior to 2025.12.5
authentik 2026.2.0-rc1 through 2026.2.2
OAuth2 providers configured with client_type: confidential

Discovery Timeline

2026-05-22 - CVE-2026-40166 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-40166

Vulnerability Analysis

The vulnerability exists in authentik's OAuth2 access token API. When a user authenticates against a confidential OAuth2 provider, authentik issues an access token and stores a reference to the provider configuration. The GET /api/v3/oauth2/access_tokens/ endpoint serializes those token records and includes a nested provider object in the response. That nested object contains the provider's client_id and client_secret, even when the requesting user has no administrative scope. As a result, any authenticated non-admin user with at least one valid OAuth2 access token can read confidential client credentials by issuing a single authenticated API request.

The credentials returned belong to the OAuth2 client application, not the user. An attacker who obtains the client_secret can impersonate the OAuth2 client in subsequent authorization code or client credentials flows. This breaks the confidentiality guarantees of the OAuth2 confidential client model.

Root Cause

The root cause is an over-permissive API serializer combined with missing field-level authorization. The serializer for the access token endpoint embeds the full provider object instead of restricting sensitive fields to administrative users. There is no permission check that suppresses client_secret when the requester lacks provider management rights.

Attack Vector

Exploitation requires network access to the authentik API and a valid low-privilege user session. The attacker authenticates to any confidential OAuth2 application protected by authentik. The attacker then sends an authenticated GET request to /api/v3/oauth2/access_tokens/ and parses the JSON response. The provider.client_secret field is read directly from the response. No special tooling, social engineering, or user interaction beyond the initial OAuth2 login is required.

The vulnerability is described in prose only because no public exploit code is currently available. Refer to the GitHub Security Advisory GHSA-hhpc-rqgm-pxj4 for the upstream technical description.

Detection Methods for CVE-2026-40166

Indicators of Compromise

Unexpected GET requests to /api/v3/oauth2/access_tokens/ originating from non-admin user sessions.
OAuth2 client authentications from new IP addresses or user agents using a known client_id shortly after a non-admin user queried the access tokens endpoint.
Token issuance spikes for confidential OAuth2 clients without corresponding legitimate user activity.

Detection Strategies

Audit authentik access logs for /api/v3/oauth2/access_tokens/ requests and correlate the requesting user's group membership against expected admin scope.
Compare the volume and frequency of access token API calls before and after the upgrade window to identify scraping behavior.
Inspect OAuth2 provider audit events for client_credentials grants that do not match historical issuance patterns for each client_id.

Monitoring Recommendations

Forward authentik API and authentication logs to a centralized SIEM and alert on non-admin access to the access tokens endpoint.
Monitor downstream applications that consume authentik-issued tokens for anomalous client authentications.
Track changes to OAuth2 provider configurations and rotate any client_secret values that were exposed during the vulnerable period.

How to Mitigate CVE-2026-40166

Immediate Actions Required

Upgrade authentik to version 2025.12.5 or 2026.2.3 as documented in the authentik 2025.12.5 release and authentik 2026.2.3 release.
Rotate the client_secret for every confidential OAuth2 provider configured in authentik, assuming exposure.
Invalidate existing OAuth2 access tokens and refresh tokens issued by affected providers to force re-authentication.
Review API audit logs for prior access to /api/v3/oauth2/access_tokens/ by non-admin accounts.

Patch Information

The maintainers fixed the issue in authentik 2025.12.5 and 2026.2.3. The patch removes the client_secret field from the serialized provider object returned by the access tokens API for non-administrative requesters. See the GitHub Security Advisory GHSA-hhpc-rqgm-pxj4 for the official advisory text.

Workarounds

Restrict network access to the authentik API so that only trusted clients can reach /api/v3/oauth2/access_tokens/ until the upgrade is applied.
Temporarily reconfigure OAuth2 providers to use public client types where the application architecture permits, eliminating the value of any leaked secret.
Disable or remove unused OAuth2 providers to reduce the attack surface during the remediation window.

bash

# Configuration example - upgrade authentik via Docker Compose
# Edit your .env file and pin the patched version:
AUTHENTIK_TAG=2026.2.3

# Then pull and restart the stack:
docker compose pull
docker compose up -d

# Verify the running version:
docker compose exec server ak version