CVE-2026-11718

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the response into an introspectResp struct. However, the subsequent claim-checking logic (validateClaims) evaluates the issuer condition as if a.issuer != "" && iss != "". If the external OAuth provider's introspection response omits the optional iss (issuer) field completely, the variable iss defaults to an empty string. This causes the conditional block to evaluate to false and be skipped silently. Consequently, the application accepts tokens issued by unauthorized or unintended third-party identity providers.

• CWE-287

• https://github.com/googleapis/mcp-toolbox/pull/3360

Published

Jun 18, 2026

Last Modified

Jun 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11707IBM Tivoli System Automation Application Manager 4.1 and IBM…9.3
• CVE-2026-11708IBM WebSphere Application Server 9.0, and 8.5 is affected by…9.3
• CVE-2026-1171A flaw has been found in birkir prime up to 0.4.0.beta.0. Im…7.5
• CVE-2026-11712IBM WebSphere Application Server 9.0, and 8.5 is affected by…9.3
• CVE-2026-11714IBM WebSphere Application Server Liberty is affected by a se…9.8
• CVE-2026-11717An authentication bypass vulnerability exists in the generic…9.3
• CVE-2026-11719An authenticated authorization bypass vulnerability exists i…8.6
• CVE-2026-1172A vulnerability has been found in birkir prime up to 0.4.0.b…7.5
• CVE-2026-11720A path traversal vulnerability exists in the HTTP tool URL b…9.1
• CVE-2026-11721It is possible for an attacker's zone to respond to a query …7.5
• CVE-2026-1173A vulnerability was found in birkir prime up to 0.4.0.beta.0…9.8
• CVE-2026-11733A buffer overflow vulnerability in the listed NETGEAR models…1.1