Which versions of Authentik are affected by CVE-2026-40166?

Authentik versions before 2025.12.5 and 2026.2.0-rc1 through 2026.2.2 expose OAuth2 provider credentials (client_secret) to any authenticated user via the GET /api/v3/oauth2/access_tokens/ endpoint.

How to fix or mitigate CVE-2026-40166?

Within 24 hours: Inventory all OAuth2 providers configured in authentik and audit downstream systems relying on their client credentials; restrict API access to /api/v3/oauth2/access_tokens/ endpoint to administrators only where possible. Within 7 days: Review authentik audit logs for suspicious access patterns to the vulnerable endpoint; rotate client_secrets for all OAuth2 providers as a precaution, documenting affected downstream systems. Within 30 days: Monitor the authentik project for vendor patch availability targeting versions 2025.12.5+ and 2026.2.3+; assess upgrade feasibility once a fix is released or evaluate whether to maintain compensating controls.

Authentik CVE-2026-40166

Q: What is the CVSS score of CVE-2026-40166?

CVE-2026-40166 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Information Exposure (CWE-200)

2026-05-22 GitHub_M

Information Disclosure Authentik

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 18:33 vuln.today

Analysis Generated

Jul 23, 2026 - 18:33 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

7.1 (HIGH)

CVE Published

May 22, 2026 - 18:52 cve.org

HIGH 7.1

CVE Published

May 22, 2026 - 18:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/access_tokens/. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3.

AnalysisAI

Sensitive information disclosure in authentik (goauthentik) before 2025.12.5 and in the 2026.2.0-rc1 through 2026.2.2 branch allows any authenticated low-privilege user holding at least one OAuth2 access token to read the client_secret of confidential OAuth2 providers they previously authenticated against. The GET /api/v3/oauth2/access_tokens/ endpoint over-returns a nested provider object containing client_id and client_secret, exposing credentials that should be restricted to administrators. No public exploit has been identified at time of analysis and EPSS is negligible (0.01%), but the flaw is a straightforward credential leak requiring only a normal user session.