The vulnerability resides in 1MCP Agent versions 0.20.0 through 0.39.0 and allows an authenticated user holding a single-tag OAuth token to craft a negated tag-filter expression such as "not <granted-tag>". When supplied, the agent incorrectly bypasses OAuth tag-scope enforcement, enabling the attacker to list and invoke tools on backend MCP servers that are normally outside their granted permissions. This defect exposes the system to unauthorized data disclosure, manipulation, or execution of privileged actions, directly compromising the integrity and confidentiality of resources managed by the MCP servers.

This issue affects the 1MCP Agent application provided by 1mcp-app, specifically the @1mcp/agent product in all releases from 0.20.0 up to and including 0.39.0.

The CVSS score of 5.3 places the vulnerability in the medium severity range, but the attack demands an authenticated OAuth token and expertise in the advanced tag-filter syntax. Because EPSS data is not available and the vulnerability is not listed in CISA KEV, the likelihood of widespread exploitation is uncertain. Nonetheless, authenticated clients can circumvent intended access controls, giving them the ability to access or manipulate backend resources beyond their granted scopes.