{"id":"ghsa-ghsa-qw47-mcm5-934w","seq":2377,"kind":"advisory","title":"A2A Java SDK has a fail-open default task authorization","url":"https://github.com/advisories/GHSA-qw47-mcm5-934w","permalink":"https://vulnpulse.app/items/ghsa-ghsa-qw47-mcm5-934w","summary":"影響: maven:org.a2aproject.sdk:a2a-java-sdk-server-common < 1.3.0.Final → 1.3.0.Final\nDraft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships._ --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (task store / authorization) - Affected versions: <= 1.2.0.Final (and 1.2.1.Final-SNAPSHOT on main prior to the fix) - Patched version: _(the release that carries the fix, e.g. 1.2.1.Final)_ - CWE: CW…","severity":"high","techs":["java","github"],"cves":["CVE-2026-111764"],"tags":["GHSA-qw47-mcm5-934w","org.a2aproject.sdk:a2a-java-sdk-server-common"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T21:05:09.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}