The vulnerability (CVE-2026-40166) in goauthentik authentik involves exposure of sensitive information (client_secret) to unauthorized actors. Authenticated non-admin users with an OAuth2 access token can access the client_secret of confidential OAuth2 providers via the GET /api/v3/oauth2/access_tokens/ API endpoint. This occurs because the API response includes a nested provider object with client_id and client_secret for providers configured as confidential, which should be restricted. The flaw affects versions before 2025.12.5 and versions from 2026.2.0-rc1 up to but not including 2026.2.3. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-863 (Incorrect Authorization).

Unauthorized disclosure of client_secret credentials for confidential OAuth2 providers can lead to compromise of OAuth2 client confidentiality, potentially enabling unauthorized access to protected resources or impersonation of the client. The vulnerability requires an authenticated user with at least one OAuth2 access token but does not require admin privileges. The CVSS 4.0 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

This vulnerability has been fixed in authentik versions 2025.12.5 and 2026.2.3. Users should upgrade to one of these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the official patch. Patch status is confirmed fixed in these versions. No additional mitigations are indicated by the vendor advisory.