A privilege‑misuse flaw in authentik allows any authenticated non‑admin user who owns at least one OAuth2 access token to read the client_secret of confidential OAuth providers. The /api/v3/oauth2/access_tokens/ endpoint returns a nested provider object that includes client_id and client_secret, exposing credentials that should be restricted to administrators. This disclosure can enable attackers to impersonate the OAuth client, generate token requests, or compromise downstream services that rely on the exposed secret.

The vulnerability affects the open‑source identity‑provider software Authentik, maintained by goauthentik. Versions prior to 2025.12.5 and the 2026.2 series up to 2026.2.2 are impacted. The issue was addressed in 2025.12.5 and 2026.2.3 releases.

With a CVSS score of 7.1, the flaw presents a high‑severity breach of confidentiality and potential integrity concerns. The EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and the possession of an OAuth2 access token, both conditions commonly satisfied within a normal user base. Attackers can abuse the disclosed client_secret to act as the OAuth client, potentially accessing protected resources or fabricating tokens.