CVE-2026-111765 with a CVSS score of 7.5 is a credential-leakage flaw in the Android HTTP client component of the A2A Java SDK, specifically the synchronous POST path used by JSONRPCTransport and RestTransport. The affected software is org.a2aproject.sdk:a2a-java-sdk-http-client-android (maven) versions greater than or equal to 1.3.0.Final and less than or equal to 1.3.1.Final. The flaw occurs because the Android client initially disables automatic redirects, but the synchronous POST builder later overwrites that setting by defaulting followRedirects to true. When a remote endpoint returns a cross-authority redirect, the Android HTTP implementation removes the standard Authorization header but retains nonstandard authentication headers. The client's authentication interceptor permits X-API-Key, API-Key, X-Auth-Token, and X-Authentication, so a remote attacker can cause a complete API key or token to be forwarded to a different authority. Exploitation requires a network-accessible Android client, a malicious or compromised remote endpoint, and no user interaction after the redirect response. The business impact is disclosure of sensitive credentials across trust boundaries, enabling unauthorized access to services that accept those credentials and weakening the confidentiality guarantees expected from the SDK.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-111765 with a CVSS score of 7.5 is a credential-leakage flaw in the Android HTTP client component of the A2A Java SDK, specifically the synchronous POST path used by JSONRPCTransport and RestTransport. The affected software is org.a2aproject.sdk:a2a-java-sdk-http-client-android (maven) versions greater than or equal to 1.3.0.Final and less than or equal to 1.3.1.Final. The flaw occurs because the Android client initially disables automatic redirects, but the synchronous POST builder later overwrites that setting by defaulting followRedirects to true. When a remote endpoint returns a cross-authority redirect, the Android HTTP implementation removes the standard Authorization header but retains nonstandard authentication headers. The client's authentication interceptor permits X-API-Key, API-Key, X-Auth-Token, and X-Authentication, so a remote attacker can cause a complete API key or token to be forwarded to a different authority. Exploitation requires a network-accessible Android client, a malicious or compromised remote endpoint, and no user interaction after the redirect response. The business impact is disclosure of sensitive credentials across trust boundaries, enabling unauthorized access to services that accept those credentials and weakening the confidentiality guarantees expected from the SDK.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]