CVE-2026-14541

Name of the Vulnerable Software and Affected Versions Google mcp-toolbox version 1.4.0

Description An authentication bypass and audience confusion issue exists in the Google OAuth provider component. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation. This allows the toolbox to accept any valid Google OAuth access token, including those created for unrelated ecosystem applications, which may grant unauthorized clients access to protected tools and data backends.

Recommendations Explicitly define the audience or clientId when initializing the Google authService with mcpEnabled: true for version 1.4.0.