Mcp Toolbox Sdk Python
Monthly
Cross-audience Google ID token reuse in the toolbox-core module of mcp-toolbox-sdk-python causes a credential intended for one service to be silently handed to a different service within the same process. Because the module-level token cache is not keyed by audience, an application that fetches ID tokens for two or more audiences in one process can send a Service A token to Service B; an attacker who operates, compromises, or passively monitors Service B can capture that token and replay it against Service A to impersonate the victim application. Exploitation is unauthenticated against the vulnerable app (PR:N) but conditional: it requires a multi-audience deployment plus attacker visibility into Service B traffic, and the leaked token is time-bounded by its expiry. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Cross-audience Google ID token reuse in the toolbox-core module of mcp-toolbox-sdk-python causes a credential intended for one service to be silently handed to a different service within the same process. Because the module-level token cache is not keyed by audience, an application that fetches ID tokens for two or more audiences in one process can send a Service A token to Service B; an attacker who operates, compromises, or passively monitors Service B can capture that token and replay it against Service A to impersonate the victim application. Exploitation is unauthenticated against the vulnerable app (PR:N) but conditional: it requires a multi-audience deployment plus attacker visibility into Service B traffic, and the leaked token is time-bounded by its expiry. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing).