This vulnerability allows an attacker who has view permission on specific authentik configuration objects to read stored credentials that are intended only for change or write operations. The exposed secrets include passwords, client secrets, and tokens used for one‑time‑code delivery, provisioning, device trust, identity sources, Kubernetes outpost integration, and applications with client or proxy providers. Because these secrets can be used to impersonate services or access external systems, the impact is the uncontrolled disclosure of credentials (CWE‑200, CWE‑522).

The issue affects the authentik identity provider released before versions 2026.2.7, 2026.5.7, and 2026.8.2. Any deployment that grants view permission to accounts on configurations such as mail or SMS one‑time code settings, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, or applications using client or shared secrets may expose those secrets. Deployments in which every viewer is intended to read them are not impacted; only accounts with unnecessary view access are vulnerable.

Authentik’s API serializers expose stored credentials when a request is made by a user that has view permission on a configuration object. The vulnerability permits an attacker with such permissions to read passwords, client secrets, and other sensitive tokens through normal API calls. The CVSS score of 8.1 indicates high severity, yet the EPSS score is not available, so exploitation probability cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet, but the ability to retrieve credentials without modification rights can lead to credential theft and lateral movement if the attacker can gain legitimate API access.