I'm confirming that this is a problem and a fix is in development.

If possible, sharing a Client ID will enable Google to more quickly verify that the fix works as intended.

Client IDs are public, included the site HTML source loaded by the browser and are generally safe to include in comments and code samples. Security is maintained by OAuth authorized origins and redirect URLs.