CVE-2026-63377

Prior to version 3.0.1-beta , the TAKO AI Agent for Okta is vulnerable to an unauthenticated first-run administrator takeover. The root cause is a missing authentication check in the initial_setup function within src/api/routers/auth.py (endpoint POST /api/auth/setup). Because the application sta...

CVE-2026-63377 TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, POST /api/auth/setup in src/api/routers/auth.py allows an unauthenticated network attacker to create the first administrator account before the legitimate...

CVE-2026-63378: fctr-id okta-ai-agent: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctrsession cookie can submit arbitrary Python source in the scriptcode field of POST /api/react/execute-script, witho...