High, CVSS 7.5MavenAmendedPublished
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
CVE-2026-111765 · GHSA-4fpj-g9jf-9rgg
- Affected
- Maven org.a2aproject.sdk:a2a-java-sdk-http-client-android >= 1.3.0.Final, <= 1.3.1.Final
- Fixed in
- 1.3.2.Final· Vendor fix available
- Issue
- The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connection = createConnection("POST", false); connection.setInstanceFollowRedirects(followRedirects); // ... } The second assignment wins. JSONRPCTransport and RestTransport both add interceptor-produced headers and call synchronous post() without setting followRedirects(false). On Android's repackaged OkHttp implementation, a cross-authority redirect strips Authorization but retains nonstandard request headers. AuthInterceptor permits four nonstandard authentication header names: X-API-Key API-Key X-Auth-Token X-Authentication I confirmed that the exact v1.3.1.Final Maven artifact forwards complete synthetic values under all four names to a second loopback authority. I also reproduced the…
Recommended action: Upgrade to 1.3.2.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.