TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover
Summary
TAKO AI Agent for Okta before 3.0.1-beta lets an unauthenticated network attacker call the setup endpoint POST /api/auth/setup and create the first administrator account before the legitimate owner completes setup. The endpoint requires no setup token or network restriction, and the default Docker Compose configuration published port 8001 on all interfaces. A successful attacker becomes the sole administrator and can read Okta-synced user data, API tokens, chat history and configuration, modify users and Okta integration credentials, lock out administrators or disable the service. Setup that is already completed is rejected.
Affected
- fctr-id TAKO AI Agent for Okta (okta-ai-agent) versions prior to 3.0.1-beta
- Installations where first-run setup has not yet been completed are exploitable; the default Docker Compose file exposed port 8001 on all interfaces
Fixed in
- Version 3.0.1-beta (fix commit 3b5ccaf)
Workaround
- No vendor workaround documented.
- Do not expose port 8001 to untrusted networks; bind it to 127.0.0.1 or block it at the firewall.
- Complete first-run setup immediately after deployment, before the service is reachable.
Exploitation
- VulDB reports no known exploit.
- No reports of exploitation in the wild or public proof of concept were found at the time of research.
- The flaw is simple and network-reachable without authentication, so this may change quickly.
Our recommendation
- Upgrade to version 3.0.1-beta or later and verify the fixed version against the vendor advisory.
- Until patched, block port 8001 from untrusted networks and do not expose the service to the internet.
- Check existing installations for unexpected administrator accounts.
- If an instance was reachable before setup was completed, or exposure cannot be ruled out, rotate Okta API tokens and integration credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-536w-42p8-3qv9 github.com
- Release v3.0.1-beta github.com
- Fix commit 3b5ccaf github.com
- VulDB entry 429442 vuldb.com
- CVE-2026-63377 advisory mirror cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:20.
Original description (NVD)
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. The `initial_setup` function checks only the `is_setup` completion flag and requires no authentication, one-time bootstrap token, or network restriction. The default `docker-compose.yml` publishes port 8001 on all interfaces, the `Dockerfile` starts the listener on 0.0.0.0, and `src/api/main.py` mounts the authentication router without a global authentication guard. The endpoint invokes `create_auth_user` with `UserRole.ADMIN` and `set_auth_cookie`, issuing a valid `fctr_session` JWT cookie. Localhost-only CORS rules do not restrict non-browser HTTP clients, and the setup operation does not require access to a real Okta tenant. The attacker becomes the sole administrator and prevents legitimate first-run setup, can read Okta-synced user data, API tokens, chat history, and application configuration, modify users and Okta integration credentials, and lock out administrators or disable the service. Already completed setup is rejected. This issue is fixed in version 3.0.1-beta.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.