CVE-2026-11718

Name of the Vulnerable Software and Affected Versions googleapis/mcp-toolbox (affected versions not specified)

Description An authentication bypass exists in the generic opaque token validation path validateOpaqueToken(). When validating an opaque token via an OAuth 2.0 introspection endpoint, the system decodes the response into an introspectResp struct. The claim-checking logic in validateClaims() evaluates the issuer condition as a.issuer != "" && iss != "". If the external OAuth provider omits the optional iss (issuer) field, the iss variable defaults to an empty string, causing the conditional block to be skipped. This allows the application to accept tokens from unauthorized or unintended third-party identity providers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.