Martin's answer has good info and steps to prevent further potential risk.
Concerning the authtoken it’s pretty straight forward.
For example, when you use your Google account to login to a site, using the following button :
Google generates a token using what's called the OAuth 2.0 protocol, allowing this website to login via Google without them ever having knowledge of your password.
Imagine a triangle in which information is exchanged from each of the three angles (3 people, illustrated as P), but information can't flow from P1 to P3(or P3->P1) without passing through P2, which funnels data.
That is the main purpose of the authtoken, a single-use (one site only) hash/token that basically allows :
P1(site) to identify themselves on "behalf" of
P2(you) to the platform of
On some apps/sites, upon first use of "Google sign in", you have to choose and accept how much data/control this particular API has over your Google account.
Nowadays, it is usually limited to seeing your email address (the address only), and some public/private info such as name, DOB and address.
So regarding security concerns, I don't believe there are any. Not only do tokens expire (meaning after prolonged time of no use, you will need to revalidate permissions, aka re-auth), but also, in the manner of cryptocurrency, this is a three way exchange where whatever site had a data leak has its own token used to identify to Google.
Let's imagine a worst case scenario where a malicious attacker manages to recreate (doubtful..) or spoof the site's token, and then used yours to identify to Google.
Their power would be limited to whatever permissions that site had on your Google account (they can vary), but remain restricted. They do not have access to the Google account itself.
Now it's safe to assume that upon discovery of the data leak, all token authorizations from this particular site were revoked; either by demand of the former or by Google, as a preventative measure.
But for peace of mind(and because knowledge is awesome!), it is worth checking the following link which shows all the apps you have tokens with and what they're allowed to do. https://myaccount.google.com/permissions
For more information about the authtoken process: https://developers.google.com/gmail/api/auth/about-auth
Hope this answered your question!
Just to be clear: authtokens do NOT store your password