## A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

- 種別: advisory
- 重大度: high
- 関連技術: java
- CVE: CVE-2026-111765
- 公開日時: 2026-10-20T21:08:06.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-4fpj-g9jf-9rgg)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-4fpj-g9jf-9rgg

影響: maven:org.a2aproject.sdk:a2a-java-sdk-http-client-android >= 1.3.0.Final, <= 1.3.1.Final → 1.3.2.Final
The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connection = createConnection("POST", false); connection.setInstanceFollowRedirects(followRedirects); // ... } The second assignment wins. JSONRPCTransport and RestTransport both add interceptor-produced head…