Executive brief
The mcp-toolbox-sdk-python library caches Google authentication tokens at the module level without distinguishing between different services. An attacker who compromises or monitors traffic to a secondary service can capture a cached token intended for a more sensitive service and replay it to impersonate the victim application. This affects applications that authenticate to multiple services within the same process.
Technical details
The toolbox-core package fails to key cached Google ID tokens by audience, causing tokens minted for one service to be reused for other services. An attacker with network access to a secondary service can intercept a token intended for a sensitive service and replay it, gaining unauthorized access. The vulnerability is a classic cache collision issue in a module-level credential store.
Affected products
- Google mcp-toolbox-sdk-python versions prior to fix in June 2026
Timeline
- 2026-09-22: disclosed