A flaw in the textbook’s token caching mechanism allows a Google ID token issued for one target audience to be stored without keying on the audience value. When an application uses the SDK to access multiple services in the same process, the module-level cache returns the same, unexpired token for a second service target even though the token’s intended audience is different. The victim application may send the recycled token to the second service, which can then acquire the original token and use it to impersonate the application against the first service.

The vulnerability affects Google’s mcp-toolbox-sdk-python toolkit, specifically the toolbox-core package used for authentication. Any deployment that uses this SDK to obtain tokens for more than one service audience within a single process is susceptible. Versions of the SDK prior to the fix referenced in the advisory, which is documented in the project’s pull‑request history, lack the proper audience keying in their cache.

With a CVSS score of 9.1 the flaw is considered critical. The EPSS score is not available, indicating no quantified exploitation probability in the public database, but the absence of exploitation data does not mean the vulnerability is safe. Attackers who can observe or influence traffic to the second service can capture the replayed token and use it to gain unauthorized access to the first service. The flaw is not listed in the CISA KEV catalog and no official workaround is published, so vigilance and remediation are essential.