PT-2026-91712 · A2A-Java · A2A-Java

Colorfullbz

·

CVE-2026-90820

·

Published

2026-09-14

·

Updated

2026-09-15

CVSS v4.0

5.3

Medium

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Name of the Vulnerable Software and Affected Versions a2aproject a2a-java version 1.2.0
Description A remote attack can lead to missing authorization due to an issue in the AuthorizationRequestHandlerDecorator.onListTasks() function located in the server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java file.
Recommendations Upgrade to version 1.3.0. As a temporary workaround, restrict access to the AuthorizationRequestHandlerDecorator.onListTasks() function to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862CWE-863

Related Identifiers

CVE-2026-90820

Affected Products

A2A-Java