authentik versions prior to 2026.2.7, 2026.5.7, and 2026.8.2 have a vulnerability where API serializers return stored credentials to accounts with view permission on affected configurations, even if those accounts lack authorization to read secrets or change configurations. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, Kubernetes outpost integration, and applications using client or shared secrets or proxy providers. Deployments where view permission is granted to accounts not intended to read these credentials are vulnerable. The issue is resolved in versions 2026.2.7, 2026.5.7, and 2026.8.2.

Unauthorized actors with view permissions on certain authentik configurations can access sensitive stored credentials, leading to exposure of secrets that could compromise identity provider security. This can result in unauthorized access or misuse of identity-related functions. The CVSS score is 8.1 (high), indicating a significant confidentiality impact with low attack complexity and low privileges required.

Upgrade authentik to version 2026.2.7, 2026.5.7, or 2026.8.2 or later to apply the official fix. Deployments should review and restrict view permissions to only those accounts authorized to access sensitive credentials. No other mitigation is required once patched.