Product

A2a-Java-Sdk-Http-Client-Android (1.3.0.Final, 1.3.1.Final)

1 brief RSS

A2A Java SDK: Android synchronous POST credential disclosure via insecure redirect (CVE-2026-111765)

The A2A Java SDK for Android fails to properly disable HTTP redirects in synchronous POST requests, allowing sensitive authentication tokens to be leaked to unauthorized authorities following a 302 redirect.

a2a-java-sdk-http-client-android cve-2026-111765 vulnerability android credential-theft

1t 1c 7h ago