Executive brief
A security flaw in Google's mcp-toolbox library allows unauthorized users to bypass authentication checks. The library fails to verify if a login token was actually intended for the specific application, meaning it will mistakenly accept valid tokens created for entirely different Google services. This could allow an attacker to gain unauthorized access to protected tools and sensitive data backends.
Technical details
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. The root cause is located in the ValidateMCPAuth pipeline, which skips audience validation for opaque tokens when the Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId. An unauthenticated remote attacker can exploit this by presenting a valid Google OAuth access token minted for a different, unrelated application. The toolbox will incorrectly accept these tokens, granting the attacker unauthorized access to protected tools and data backends. A fix has been merged into the main branch to enforce mandatory audience or clientId configuration.
Affected products
- Google mcp-toolbox 1.4.0
Timeline
- 2026-06-18: patched: Fix merged in GitHub PR #3450
- 2026-07-31: advisory: CVE published to NVD