// OktaCRITICAL
CVE-2026-63377 is a critical unauthenticated setup bypass in TAKO AI Agent for Okta (versions prior to 3.0.1-beta) with CVSS 9.8 score. The vulnerable POST /api/auth/setup endpoint lacks authentication controls, allowing remote attackers to create administrator accounts before initial setup completion. Successful exploitation grants full administrative access to Okta-synced user data, API tokens, and service control. The default Docker configuration exposes the service on 0.0.0.0, broadening attack surface.
// Get alerts for Okta