An authentication bypass and audience confusion flaw exists in the Google OAuth provider component of Google mcp-toolbox. When a Google authService is initialized with mcpEnabled set to true but does not supply an explicit audience or clientId, the token validation step for opaque tokens skips audience checks. Consequently the library accepts any valid Google OAuth access token, including those issued for unrelated applications, allowing attackers to use those tokens to gain unauthorized access to the toolbox and its backend data.

The vulnerability affects Google MCP Toolbox version 1.4.0. No other versions or vendors are listed as affected.

The CVSS score of 8 indicates high severity, and the EPSS score is <1%, indicating a very low current exploitation likelihood. The vulnerability is not listed in CISA KEV. The attack vector is remotely exploitable via any OAuth interaction with the toolbox; an attacker can simply present a legitimate but mis‑audience token and gain access without authenticating to the toolbox itself.