A2A Java SDK: Android synchronous POST credential disclosure via insecure redirect (CVE-2026-111765)

The A2A Java SDK for Android (versions 1.3.0.Final and 1.3.1.Final) contains a critical regression where synchronous POST requests ignore previously implemented security patches to disable HTTP redirects. While the AndroidA2AHttpClient.createConnection() method correctly initializes connections with setInstanceFollowRedirects(false), the synchronous POST builder explicitly overrides this setting with followRedirects = true.

When an application uses this SDK to communicate with a compromised or malicious remote agent, the client may follow an unauthorized 302 redirect. Because the redirect process on Android's repackaged OkHttp implementation preserves nonstandard request headers, the SDK inadvertently forwards sensitive credentials - specifically those under X-API-Key, API-Key, X-Auth-Token, and X-Authentication - to the attacker-controlled destination. This vulnerability represents an incomplete remediation of the security property defined in the A2A Project's security model, which mandates that automatic redirects must be disabled to prevent credential leakage.

Attack Chain

1. The victim application initiates a synchronous HTTP POST request using the a2a-java-sdk-http-client-android library.
2. The AuthInterceptor injects sensitive authentication tokens into the request headers.
3. The AndroidA2AHttpClient.post() method executes, establishing a connection that defaults to followRedirects = true.
4. The client contacts a malicious or compromised remote agent.
5. The attacker-controlled server responds with a 302 HTTP status code and a location header pointing to an attacker-controlled endpoint.
6. The AndroidA2AHttpClient automatically follows the redirect.
7. The Android OkHttp internal engine preserves the authentication headers while stripping the standard Authorization header during the cross-authority transition.
8. The attacker-controlled endpoint receives and logs the victim's authentication credentials.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive API keys or authentication tokens to an attacker-controlled authority. This vulnerability affects any Android application utilizing the a2a-java-sdk-http-client-android component (v1.3.0.Final through v1.3.1.Final). While the report does not demonstrate subsequent system compromise or remote code execution, it confirms the leakage of synthetic credentials to ephemeral loopback listeners, confirming the feasibility of token theft in production environments.

Recommendation

Prioritized, concrete actions for developers and security teams:

• Patch the A2A Java SDK by modifying the synchronous POST builder to set followRedirects = false as the default, consistent with the security model for other client implementations.
• Audit applications using the a2a-java-sdk-http-client-android library to ensure they are not relying on automated redirect behavior for POST requests.
• Rotate any credentials that may have been exposed through this mechanism if the application has interacted with untrusted or compromised A2A remote agents.
• Verify patch application by running the AndroidA2AHttpClientRedirectTest fixture to ensure the followRedirects(false) property is strictly enforced during synchronous operations.