Google fixed a flaw in its OAuth client library for Java that could allow attackers with a compromised token to deploy malicious payloads.