{"id":"CVE-2026-63377","published":"2026-10-30T23:17:14.267","lastModified":"2026-10-30T23:17:14.267","description":"TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. The `initial_setup` function checks only the `is_setup` completion flag and requires no authentication, one-time bootstrap token, or network restriction. The default `docker-compose.yml` publishes port 8001 on all interfaces, the `Dockerfile` starts the listener on 0.0.0.0, and `src/api/main.py` mounts the authentication router without a global authentication guard. The endpoint invokes `create_auth_user` with `UserRole.ADMIN` and `set_auth_cookie`, issuing a valid `fctr_session` JWT cookie. Localhost-only CORS rules do not restrict non-browser HTTP clients, and the setup operation does not require access to a real Okta tenant. The attacker becomes the sole administrator and prevents legitimate first-run setup, can read Okta-synced user data, API tokens, chat history, and application configuration, modify users and Okta integration credentials, and lock out administrators or disable the service. Already completed setup is rejected. This issue is fixed in version 3.0.1-beta.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8423cdfa6d26f5e133c01b8b71148df4","tags":[]},{"url":"https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta","tags":[]},{"url":"https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-536w-42p8-3qv9","tags":[]}],"exploitRefs":[{"url":"https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8423cdfa6d26f5e133c01b8b71148df4","tags":[]},{"url":"https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta","tags":[]},{"url":"https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-536w-42p8-3qv9","tags":[]}],"hasPoc":true,"ai":{"summary":"The TAKO AI Agent for Okta exposes an unauthenticated endpoint that allows any remote attacker to create an administrator account before initial setup completes, bypassing authentication entirely due to missing access controls and bootstrap protections.","exploitability":"Exploitation is trivial for a remote attacker with network access to the service on port 8001; no authentication, tokens, or user interaction is required.","blast_radius":"Successful exploitation grants full administrative control over the agent, enabling theft of Okta-integrated credentials and user data, modification of system configuration, and denial of service by locking out legitimate administrators.","remediation":"Upgrade to version 3.0.1-beta or later, which fixes the vulnerability by enforcing proper setup state checks and authentication before allowing administrator creation.","detection":"Look for POST requests to /api/auth/setup from external IP addresses during the initial setup window, especially with empty or missing session cookies and without prior authentication events; such requests should be rare or nonexistent in a properly configured deployment.","tags":["auth-bypass","pre-auth-rce","web","container-exposure"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:47:43.044Z"}}