{"id":"ghsa-ghsa-4fpj-g9jf-9rgg","seq":2375,"kind":"advisory","title":"A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix","url":"https://github.com/advisories/GHSA-4fpj-g9jf-9rgg","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4fpj-g9jf-9rgg","summary":"影響: maven:org.a2aproject.sdk:a2a-java-sdk-http-client-android >= 1.3.0.Final, <= 1.3.1.Final → 1.3.2.Final\nThe GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connection = createConnection(\"POST\", false); connection.setInstanceFollowRedirects(followRedirects); // ... } The second assignment wins. JSONRPCTransport and RestTransport both add interceptor-produced head…","severity":"high","techs":["java"],"cves":["CVE-2026-111765"],"tags":["GHSA-4fpj-g9jf-9rgg","org.a2aproject.sdk:a2a-java-sdk-http-client-android"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T21:08:06.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}