Haonh

**Name of the Vulnerable Software and Affected Versions** googleapis/mcp-toolbox (affected versions not specified) **Description** An authentication bypass exists in the generic opaque token validation path `validateOpaqueToken()`. When validating an opaque token via an OAuth 2.0 introspection endpoint, the system decodes the response into an `introspectResp` struct. The claim-checking logic in `validateClaims()` evaluates the issuer condition as `a.issuer != "" && iss != ""`. If the external OAuth provider omits the optional `iss` (issuer) field, the `iss` variable defaults to an empty string, causing the conditional block to be skipped. This allows the application to accept tokens from unauthorized or unintended third-party identity providers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.