diff --git a/CHANGELOG.md b/CHANGELOG.md
index 418c25f2..e71add44 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ and this project adheres to
 - 🌐(frontend) improve German translation #1125
 - 🔨(python-env) migrate meet main app to UV #1120
 - ♻️(backend) align Application model field with `is_active` convention #1133
+- 🔐(backend) avoids revealing the inactive status of an application #1135
 
 ### Fixed
 
diff --git a/src/backend/core/external_api/viewsets.py b/src/backend/core/external_api/viewsets.py
index 530ef9cd..f714cb16 100644
--- a/src/backend/core/external_api/viewsets.py
+++ b/src/backend/core/external_api/viewsets.py
@@ -61,12 +61,12 @@ class ApplicationViewSet(viewsets.ViewSet):
         except models.Application.DoesNotExist as e:
             raise drf_exceptions.AuthenticationFailed("Invalid credentials") from e
 
-        if not application.is_active:
-            raise drf_exceptions.AuthenticationFailed("Application is inactive")
-
         if not check_password(client_secret, application.client_secret):
             raise drf_exceptions.AuthenticationFailed("Invalid credentials")
 
+        if not application.is_active:
+            raise drf_exceptions.AuthenticationFailed("Application is inactive")
+
         email = serializer.validated_data["scope"]
         try:
             validate_email(email)