CyberSecBulletin

Fctr-id vulnerabilities

We track 2 vulnerabilities in Fctr-id products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.

2vulnerabilities
1critical
1high
0exploited
9.3average CVSS score

Latest Fctr-id vulnerabilities

  • 8.8 High severity

    okta-ai-agent: Improper Control of Generation of Code

    CVE-2026-63378Fctr-id

    TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` fie

  • 9.8 Critical severity

    okta-ai-agent: Missing Authentication for Critical Functionality

    CVE-2026-63377Fctr-id

    TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first ad