PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40166 goauthentik CVE debrief

CVE-2026-40166 is a vulnerability in the authentik open-source identity provider. Authentik versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2 contain a flaw that allows authenticated non-admin users with at least one OAuth2 access token to retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against. This issue exposes sensitive information to users without the correct permissions via the GET /api/v3/oauth2/access_tokens/ API endpoint. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential. This vulnerability has been fixed in versions 2025.12.5 and 2026.2.3.

Vendor
goauthentik
Product
authentik
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-07-23
Advisory published
2026-05-22
Advisory updated
2026-07-23

Who should care

Users of authentik open-source identity provider versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2 should be aware of this vulnerability. Specifically, administrators of authentik instances should assess the risk and apply patches or mitigations as necessary. Authentik users with OAuth2 access tokens should also be cautious about potential unauthorized access to sensitive information.

Technical summary

The vulnerability in authentik allows authenticated non-admin users to access sensitive information about confidential OAuth2 providers. This is possible because the GET /api/v3/oauth2/access_tokens/ API endpoint returns a nested provider object containing client_id and client_secret for confidential providers. The flaw exists in authentik versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2. The CVSS score for this vulnerability is 7.1, indicating a high severity level.

Defensive priority

High priority should be given to patching or mitigating this vulnerability in authentik instances. Administrators should review their instances' configurations and user permissions to minimize potential exposure. Implementing compensating controls, such as monitoring API access and restricting user permissions, may also be necessary.

Recommended defensive actions

  • Patch authentik to version 2025.12.5 or 2026.2.3
  • Review and restrict user permissions for accessing OAuth2 providers
  • Monitor API access for suspicious activity
  • Implement additional security measures for confidential OAuth2 providers
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-22T19:17:03.763Z and was last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. The vulnerability was reported by [email protected] and is tracked under GHSA-hhpc-rqgm-pxj4.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40166 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40166

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40166 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40166

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.