The vulnerability exists in Google mcp-toolbox version 1.4.0's Google OAuth provider component. Specifically, if the authService is initialized with mcpEnabled set to true but lacks an explicit audience or clientId, the ValidateMCPAuth pipeline for opaque tokens does not perform audience validation. Consequently, the toolbox accepts any valid Google OAuth access token regardless of its intended audience, enabling unauthorized clients to access protected resources. This is classified under CWE-287 (Improper Authentication). The CVSS v3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Unauthorized clients can gain access to protected tools and data backends by presenting any valid Google OAuth access token, even those minted for unrelated ecosystem applications. This compromises confidentiality of the protected resources without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that the Google authService is initialized with an explicitly defined audience or clientId to enforce proper audience validation and prevent acceptance of tokens intended for other applications.