Authentication Bypass Vulnerability in Google OAuth Provider of Google MCP Toolbox

CVE-2026-14541

What is CVE-2026-14541?

In the Google MCP Toolbox version 1.4.0, a flaw in the Google OAuth provider allows an authentication bypass due to improper audience validation. When the Google authService is configured with mcpEnabled set to true, but without a defined audience or clientId, the validation pipeline for opaque tokens neglects audience checks. This vulnerability potentially allows unauthorized clients to gain access to sensitive tools and data by accepting any valid Google OAuth access token, including those issued for unrelated applications.

References