The Google Agent Development Kit contains a missing authorization check that allows an attacker, who can inject or manipulate events in a session history, to forge tool confirmation responses. This enables the execution of unauthorized tools, granting the attacker the privileges of the executing agent and potentially compromising confidentiality, integrity, and availability. The weakness is a type of Missing Authorization (CWE‑863).

Google's Agent Development Kit (ADK) is affected. No specific affected versions were provided in the advisory, so any deployment of ADK prior to a security update may be vulnerable.

The vulnerability has a CVSS score of 9.3, indicating a high risk if exploited. The EPSS score is less than 1%, suggesting that exploitation evidence is currently rare but the low likelihood does not mitigate the severity. The issue is not listed in the CISA KEV catalog. An attacker who can compromise or otherwise control session history can execute arbitrary tools by forging confirmations, so the attack vector is likely through any component that accepts or allows manipulation of session history. Organizations should consider the potential impact and plan remediation accordingly.