PatchSiren cyber security CVE debrief
CVE-2026-40166 goauthentik CVE debrief
CVE-2026-40166 is a vulnerability in the authentik open-source identity provider. Authentik versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2 contain a flaw that allows authenticated non-admin users with at least one OAuth2 access token to retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against. This issue exposes sensitive information to users without the correct permissions via the GET /api/v3/oauth2/access_tokens/ API endpoint. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential. This vulnerability has been fixed in versions 2025.12.5 and 2026.2.3.
- Vendor
- goauthentik
- Product
- authentik
- CVSS
- HIGH 7.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-22
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-05-22
- Advisory updated
- 2026-07-23
Who should care
Users of authentik open-source identity provider versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2 should be aware of this vulnerability. Specifically, administrators of authentik instances should assess the risk and apply patches or mitigations as necessary. Authentik users with OAuth2 access tokens should also be cautious about potential unauthorized access to sensitive information.
Technical summary
The vulnerability in authentik allows authenticated non-admin users to access sensitive information about confidential OAuth2 providers. This is possible because the GET /api/v3/oauth2/access_tokens/ API endpoint returns a nested provider object containing client_id and client_secret for confidential providers. The flaw exists in authentik versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2. The CVSS score for this vulnerability is 7.1, indicating a high severity level.
Defensive priority
High priority should be given to patching or mitigating this vulnerability in authentik instances. Administrators should review their instances' configurations and user permissions to minimize potential exposure. Implementing compensating controls, such as monitoring API access and restricting user permissions, may also be necessary.
Recommended defensive actions
- Patch authentik to version 2025.12.5 or 2026.2.3
- Review and restrict user permissions for accessing OAuth2 providers
- Monitor API access for suspicious activity
- Implement additional security measures for confidential OAuth2 providers
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-05-22T19:17:03.763Z and was last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. The vulnerability was reported by [email protected] and is tracked under GHSA-hhpc-rqgm-pxj4.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-22T19:17:03.763Z and has not been modified since then. The NVD entry is currently Deferred.