High
authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
Type: advisorySources: OSV
authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/access_tokens/. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-40166
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 16:35 UTC · Revision 1
Source evidence
authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/
core-osv · Original sourcePublished 22 May 2026, 18:52 UTC
authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/access_tokens/. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3.
osv:CVE-2026-40166
Complete source record
{
"id": "dee434d742874160dea3a06ed44ef8ebbb63cef021435e013f1c2e1192fd476a",
"url": "https://osv.dev/vulnerability/CVE-2026-40166",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/",
"summary": "authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/access_tokens/. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3.",
"evidence": "osv:CVE-2026-40166",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-40166",
"aliases": [
"BIT-authentik-2026-40166",
"CVE-2026-40166",
"GHSA-hhpc-rqgm-pxj4"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/goauthentik/authentik",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "c89d7c12d0d0cc213c43758475fe5f44e893b0cd"
},
{
"introduced": "3394c17bfd5e208f8e8d53e450158e486afe575b"
},
{
"fixed": "095e2897d52397962d153be2d689cedcdb71906c"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2025.12.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2026.2.0-rc1"
},
{
"fixed": "2026.2.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
}
],
"versions": [
"version/2026.2.3-rc1",
"version/2026.2.2",
"version/2026.2.2-rc3",
"version/2026.2.2-rc2",
"version/2026.2.2-rc1",
"version/2026.2.1",
"version/2026.2.1-rc1",
"version/2026.2.0",
"version/2026.2.0-rc5",
"version/2026.2.0-rc4",
"version/2026.2.0-rc3",
"version/2025.12.4",
"version/2026.2.0-rc2",
"version/2026.2.0-rc1",
"version/2025.12.3",
"version/2025.12.2",
"version/2025.12.1",
"version/2025.12.0",
"version/2025.12.0-rc3",
"version/2025.12.0-rc2",
"version/2025.12.0-rc1",
"version/2023.10.0",
"version/2023.8.2",
"version/2023.8.1",
"version/2023.8.0",
"version/2023.6.0",
"version/2023.5.1",
"version/2023.2.1",
"version/2022.12.1",
"version/2022.12.0",
"version/2022.10.1",
"version/2022.9.0",
"version/2022.8.2",
"version/2022.8.1",
"version/2022.7.2",
"version/2022.6.2",
"version/2022.5.2",
"version/2022.5.1",
"version/2022.4.1",
"version/2022.3.3",
"version/2022.2.1",
"version/2022.1.4",
"version/2022.1.3",
"version/2022.1.1",
"version/2021.12.5",
"version/2021.12.4",
"version/2021.12.3",
"version/2021.12.2",
"version/2021.12.1",
"version/2021.12.1-rc5",
"version/2021.12.1-rc4",
"version/2021.12.1-rc3",
"version/2021.12.1-rc2",
"version/2021.12.1-rc1",
"version/2021.10.4",
"version/2021.10.3",
"version/2021.10.1-rc3",
"version/2021.9.3",
"version/2021.9.2",
"version/2021.9.1",
"version/2021.9.1-rc3",
"version/2021.9.1-rc2",
"version/2021.9.1-rc1",
"version/2021.8.4",
"version/2021.8.3",
"version/2021.8.2",
"version/2021.8.1",
"version/2021.8.1-rc2",
"version/2021.7.1",
"version/2021.7.1-rc1",
"version/2021.6.4",
"version/2021.6.3",
"version/2021.6.1",
"version/2021.6.1-rc4",
"version/2021.6.1-rc3",
"version/2021.6.1-rc2",
"version/2021.6.1-rc1",
"version/2021.5.2",
"version/2021.5.1",
"version/2021.5.1-rc10",
"version/2021.5.1-rc9",
"version/2021.5.1-rc8",
"version/2021.4.1",
"version/2021.4.1-rc2",
"version/2021.4.1-rc1",
"version/2021.3.4",
"version/2021.3.3",
"version/2021.3.2",
"version/2021.3.1",
"version/2021.3.1-rc2",
"version/2021.3.1-rc1",
"version/2021.2.3-stable",
"version/2021.2.2-stable",
"version/2021.1.3-stable",
"version/2021.1.2-stable",
"version/2021.1.1-stable",
"version/2021.1.1-rc2",
"version/2021.1.1-rc1",
"version/0.13.3-stable",
"version/0.13.2-stable",
"version/0.13.1-stable",
"version/0.13.0-stable",
"version/0.13.0-rc4",
"version/0.13.0-rc3",
"version/0.13.0-rc2",
"version/0.13.0-rc1",
"version/0.12.11-stable",
"version/0.12.10-stable",
"version/0.12.9-stable",
"version/0.12.8-stable",
"version/0.12.7-stable",
"version/0.12.6-stable",
"version/0.12.5-stable",
"version/0.12.4-stable",
"version/0.12.3-stable",
"version/0.12.2-stable",
"version/0.12.1-stable",
"version/0.12.0-stable",
"version/0.11.0-stable",
"version/0.10.9-stable",
"version/0.10.8-stable",
"version/0.10.7-stable",
"version/0.10.6-stable",
"version/0.10.5-stable",
"version/0.10.4-stable",
"version/0.10.3-stable",
"version/0.10.2-stable",
"version/0.10.1-stable",
"version/0.10.0-stable",
"version/0.10.0-rc6",
"version/0.10.0-rc5",
"version/0.10.0-rc4",
"version/0.10.0-rc3",
"version/0.10.0-rc2",
"version/0.10.0-rc1",
"version/0.9.0-stable",
"version/0.9.0-rc2",
"version/0.9.0-rc1",
"version/0.9.0-pre7",
"version/0.9.0-pre6",
"version/0.9.0-pre5",
"version/0.9.0-pre4",
"version/0.9.0-pre3",
"version/0.9.0-pre2",
"version/0.9.0-pre1",
"version/0.8.15-beta",
"version/0.8.14-beta",
"version/0.8.12-beta",
"version/0.8.11-beta",
"version/0.8.10-beta",
"version/0.8.9-beta",
"version/0.8.8-beta",
"version/0.8.7-beta",
"version/0.8.6-beta",
"version/0.8.5-beta",
"version/0.8.4-beta",
"version/0.8.3-beta",
"version/0.8.2-beta",
"version/0.8.1-beta",
"version/0.8.0-beta",
"version/0.7.17-beta",
"version/0.7.16-beta",
"version/0.7.15-beta",
"version/0.7.14-beta",
"version/0.7.13-beta",
"version/0.7.12-beta",
"version/0.7.11-beta",
"version/0.7.10-beta",
"version/0.7.9-beta",
"version/0.7.8-beta",
"version/0.7.7-beta",
"version/0.7.6-beta",
"version/0.7.5-beta",
"version/0.7.4-beta",
"version/0.7.3-beta",
"version/0.7.2-beta",
"version/0.7.1-beta",
"version/0.7.0-beta",
"version/0.6.3-beta",
"version/0.6.2-beta",
"version/0.6.1-beta",
"version/0.6.0-beta",
"version/0.5.0-beta",
"version/0.4.2-beta",
"version/0.4.1-beta",
"version/0.4.0-beta",
"version/0.3.0-beta",
"version/0.2.8-beta",
"version/0.2.7-beta",
"version/0.2.6-beta",
"version/0.2.5-beta",
"version/0.2.4-beta",
"version/0.2.3-beta",
"version/0.2.2-beta",
"version/0.2.1-beta",
"version/0.2.0-beta",
"version/0.1.38-beta",
"version/0.1.37-beta",
"version/0.1.36-beta",
"version/0.1.35-beta",
"version/0.1.34-beta",
"version/0.1.33-beta",
"version/0.1.32-beta",
"version/0.1.31-beta",
"version/0.1.30-beta",
"version/0.1.29-beta",
"version/0.1.28-beta",
"version/0.1.27-beta",
"version/0.1.26-beta",
"version/0.1.25-beta",
"version/0.1.24-beta",
"version/0.1.23-beta",
"version/0.1.22-beta",
"version/0.1.21-beta",
"version/0.1.20-beta",
"version/0.1.19-beta",
"version/0.1.18-beta",
"version/0.1.17-beta",
"version/0.1.16-beta",
"version/0.1.15-beta",
"version/0.1.14-beta",
"version/0.1.13-beta",
"version/0.1.12-beta",
"version/0.1.11-beta",
"version/0.1.10-beta",
"version/0.1.9-beta",
"version/0.1.8-beta",
"version/0.1.7-beta",
"version/0.1.6-beta",
"version/0.1.5-beta",
"version/0.1.4-beta",
"version/0.1.3-beta",
"version/0.1.2-beta",
"version/0.1.1-beta",
"version/0.1.0-beta",
"version/0.0.13-alpha",
"version/0.0.12-alpha",
"version/0.0.11-alpha",
"version/0.0.10-alpha",
"version/0.0.9-alpha",
"version/0.0.8-alpha",
"version/0.0.7-alpha",
"version/0.0.6-alpha",
"version/0.0.5-alpha",
"version/0.0.4-alpha",
"version/0.0.3-alpha",
"version/0.0.2-alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40166.json"
}
}
],
"modified": "2026-10-28T02:30:37.406900578Z",
"provider": "osv",
"references": [
"https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.5",
"https://github.com/goauthentik/authentik/releases/tag/version%2F2026.2.3",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40166.json",
"https://github.com/goauthentik/authentik/security/advisories/GHSA-hhpc-rqgm-pxj4",
"https://nvd.nist.gov/vuln/detail/CVE-2026-40166"
],
"provider_metadata": {
"cwe_ids": [
"CWE-200",
"CWE-863"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40166.json"
}
},
"related_cves": [
{
"value": "CVE-2026-40166",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504768,
"published_at": "2026-05-22T18:52:46.65+00:00"
}