CVE-2026-11718

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the response into an introspectResp struct. However, the subsequent claim-checking logic (validateClaims) evaluates the issuer condition as if a.issuer != "" && iss != "". If the external OAuth provider's introspection response omits the optional iss (issuer) field completely, the variable iss defaults to an empty string. This causes the conditional block to evaluate to false and be skipped silently. Consequently, the application accepts tokens issued by unauthorized or unintended third-party identity providers.

• CWE-287

• https://github.com/googleapis/mcp-toolbox/pull/3360Patch

Published

Jun 18, 2026

Last Modified

Aug 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11710IBM WebSphere Application Server 8.5 is affected by an HTTP …6.5
• CVE-2026-11711IBM WebSphere Application Server 9.0 and 8.5 is affected by …6.5
• CVE-2026-11712IBM WebSphere Application Server 9.0, and 8.5 is affected by…9.3
• CVE-2026-11714IBM WebSphere Application Server Liberty is affected by a se…9.8
• CVE-2026-11716IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an…7.5
• CVE-2026-11717An authentication bypass vulnerability exists in the generic…9.1
• CVE-2026-11719An authenticated authorization bypass vulnerability exists i…8.1
• CVE-2026-1172A vulnerability has been found in birkir prime up to 0.4.0.b…7.5
• CVE-2026-11720A path traversal vulnerability exists in the HTTP tool URL b…9.1
• CVE-2026-11721It is possible for an attacker's zone to respond to a query …7.5
• CVE-2026-11722IBM WebSphere Application Server and WebSphere Application S…4.8
• CVE-2026-11725IBM MQ could allow an authenticated attacker to cause a deni…8.8