Local Authentication Bypass in TAKO AI Agent for Okta

CVE-2026-63377

What is CVE-2026-63377?

TAKO AI Agent for Okta allows a network attacker to create an initial administrator account without authentication before the legitimate owner completes the setup process. The vulnerability arises from the endpoint POST /api/auth/setup, which fails to enforce proper authentication checks. This allows an attacker to assume administrative control, gaining access to sensitive data such as Okta-synced user information, API tokens, and application configurations. The attacker can modify user roles, disable services, and prevent legitimate access. This significant security risk has been resolved in version 3.0.1-beta.

References