The TAKO AI Agent for Okta contains an authentication bypass flaw that allows a network attacker to issue an unauthenticated POST request to the /api/auth/setup endpoint. Because the endpoint performs only a flag check for an existing setup, the request creates an administrator account, sets a session cookie, and grants full admin privileges. The attacker can then read synced user data, API tokens, chat history, application configurations, and modify integral Okta settings. This results in a complete takeover of the tenant’s administrative controls.

The vulnerability exists in all releases of the Okta AI Agent before version 3.0.1‑beta. The product is distributed as a Docker image that, by default, listens on port 8001 on all network interfaces. The Dockerfile and server code expose this port and mount authentication routes without a global guard, enabling the setup route to be accessed from any client.

The CVSS base score of 9.8 indicates a critical security flaw, and the absence of an EPSS score reflects a lack of publicly known exploitation data. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is clear: an unauthenticated HTTP client can trigger the setup route from any network location that can reach the container’s port 8001. As the flaw allows creation of a privileged administrator account without credentials, it provides immediate full control over the tenant. The patch in release 3.0.1‑beta (which enforces authentication and limits exposure) is the definitive mitigation.