okta-ai-agent vulnerabilities

2 known vulnerabilities in okta-ai-agent from Fctr-id. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  okta-ai-agent: Improper Control of Generation of Code

  CVE-2026-63378Oct 30, 2026Fctr-id

  TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` fie

• 9.8 Critical severity

  okta-ai-agent: Missing Authentication for Critical Functionality

  CVE-2026-63377Oct 30, 2026Fctr-id

  TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first ad