Okta AI Agent CVE-2026-63377

Requires an instance of okta-ai-agent v3.0.0-beta that has NOT yet completed initial setup (the is_setup flag is false) and whose HTTPS port 8001 is reachable by the attacker. The default docker-compose.yml publishes 8001 on all interfaces and the Dockerfile binds uvicorn to 0.0.0.0, so a default deployment on any network reachable from untrusted hosts is exploitable with no authentication, no bootstrap token, and no IP restriction. The localhost-only CORS rule is browser-enforced only and does not stop non-browser clients (curl, Python), so it provides no protection. Limiting factors: exploitation is confined to the first-run window - once legitimate setup is completed the endpoint returns HTTP 400 and rejects further setup - and a deployment that binds the port to localhost or an internal network reduces exposure. The setup call does not require access to a real Okta tenant.

All available signals align toward high real-world priority for anyone actually running this product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst case: a network-reachable, low-complexity, unauthenticated, no-interaction flaw with full C/I/A impact (9.8 Critical), and the GHSA advisory independently confirms the mechanism matches CWE-306 (missing authentication for a critical function) rather than a subtle memory bug. The vuln.today decision label is act_now, and the advisory contains complete working exploit code (poc.py plus manual curl steps) whose success was confirmed by live-container dynamic reproduction - so publicly available exploit code exists and the barrier to weaponization is essentially zero. The key tempering signal is that this is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread in-the-wild exploitation; the urgency is driven by trivial exploitability plus a public exploit, not by observed attacks. The other limiting factor is state-dependent: exploitation only works during the first-run window before the legitimate owner completes setup (the is_setup flag gates it), which narrows the opportunity but does not reduce severity when the window is open. Net: for exposed, not-yet-initialized deployments this is a genuine act-now item; for a large population it is moderated by the product's very small deployment footprint and the fact that already-initialized instances are not vulnerable.

An attacker who can reach a freshly deployed okta-ai-agent instance on its exposed HTTPS port 8001 sends a single unauthenticated POST to /api/auth/setup with attacker-chosen credentials before the legitimate owner finishes initial setup; the server creates the account with UserRole.ADMIN and returns a valid fctr_session JWT cookie. The attacker is now the sole administrator and can read Okta-synced user data, API tokens, and chat history, alter Okta integration credentials, and lock out the owner. A complete working PoC (poc.py and manual curl commands) is published in the GHSA advisory and was confirmed by live dynamic reproduction.