CVE-2026-111765

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions 1.3.0.Final through 1.3.1.Final

Description The AndroidA2AHttpClient synchronous POST path incorrectly overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection() with a default followRedirects value of true. This occurs because the post() function applies the followRedirects variable after the connection is created, effectively enabling redirects.

When JSONRPCTransport and RestTransport call the synchronous post() method without explicitly disabling redirects, the AuthInterceptor may add authentication headers. While Android's repackaged OkHttp implementation strips the standard Authorization header during cross-authority redirects, it retains nonstandard headers. This can lead to the disclosure of a complete API key or token to an external authority if the following headers are used:

Recommendations Update A2A Java SDK to version 1.3.2.Final. As a temporary workaround, explicitly call followRedirects(false) to prevent redirected requests.