{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111765/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:a2a_project:a2a_java_sdk_http_client_android:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111765"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["a2a-java-sdk-http-client-android (1.3.0.Final, 1.3.1.Final)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-111765","vulnerability","android","credential-theft"],"_cs_type":"advisory","_cs_vendors":["A2A Project"],"content_html":"\u003cp\u003eThe A2A Java SDK for Android (versions 1.3.0.Final and 1.3.1.Final) contains a critical regression where synchronous POST requests ignore previously implemented security patches to disable HTTP redirects. While the \u003ccode\u003eAndroidA2AHttpClient.createConnection()\u003c/code\u003e method correctly initializes connections with \u003ccode\u003esetInstanceFollowRedirects(false)\u003c/code\u003e, the synchronous POST builder explicitly overrides this setting with \u003ccode\u003efollowRedirects = true\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eWhen an application uses this SDK to communicate with a compromised or malicious remote agent, the client may follow an unauthorized 302 redirect. Because the redirect process on Android's repackaged OkHttp implementation preserves nonstandard request headers, the SDK inadvertently forwards sensitive credentials - specifically those under \u003ccode\u003eX-API-Key\u003c/code\u003e, \u003ccode\u003eAPI-Key\u003c/code\u003e, \u003ccode\u003eX-Auth-Token\u003c/code\u003e, and \u003ccode\u003eX-Authentication\u003c/code\u003e - to the attacker-controlled destination. This vulnerability represents an incomplete remediation of the security property defined in the A2A Project's security model, which mandates that automatic redirects must be disabled to prevent credential leakage.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe victim application initiates a synchronous HTTP POST request using the \u003ccode\u003ea2a-java-sdk-http-client-android\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAuthInterceptor\u003c/code\u003e injects sensitive authentication tokens into the request headers.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAndroidA2AHttpClient.post()\u003c/code\u003e method executes, establishing a connection that defaults to \u003ccode\u003efollowRedirects = true\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe client contacts a malicious or compromised remote agent.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled server responds with a 302 HTTP status code and a location header pointing to an attacker-controlled endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAndroidA2AHttpClient\u003c/code\u003e automatically follows the redirect.\u003c/li\u003e\n\u003cli\u003eThe Android OkHttp internal engine preserves the authentication headers while stripping the standard \u003ccode\u003eAuthorization\u003c/code\u003e header during the cross-authority transition.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled endpoint receives and logs the victim's authentication credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of sensitive API keys or authentication tokens to an attacker-controlled authority. This vulnerability affects any Android application utilizing the \u003ccode\u003ea2a-java-sdk-http-client-android\u003c/code\u003e component (v1.3.0.Final through v1.3.1.Final). While the report does not demonstrate subsequent system compromise or remote code execution, it confirms the leakage of synthetic credentials to ephemeral loopback listeners, confirming the feasibility of token theft in production environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for developers and security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the A2A Java SDK by modifying the synchronous POST builder to set \u003ccode\u003efollowRedirects = false\u003c/code\u003e as the default, consistent with the security model for other client implementations.\u003c/li\u003e\n\u003cli\u003eAudit applications using the \u003ccode\u003ea2a-java-sdk-http-client-android\u003c/code\u003e library to ensure they are not relying on automated redirect behavior for POST requests.\u003c/li\u003e\n\u003cli\u003eRotate any credentials that may have been exposed through this mechanism if the application has interacted with untrusted or compromised A2A remote agents.\u003c/li\u003e\n\u003cli\u003eVerify patch application by running the \u003ccode\u003eAndroidA2AHttpClientRedirectTest\u003c/code\u003e fixture to ensure the \u003ccode\u003efollowRedirects(false)\u003c/code\u003e property is strictly enforced during synchronous operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T23:53:24Z","date_published":"2026-10-20T23:53:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-a2a-java-sdk-redirect/","summary":"The A2A Java SDK for Android fails to properly disable HTTP redirects in synchronous POST requests, allowing sensitive authentication tokens to be leaked to unauthorized authorities following a 302 redirect.","title":"A2A Java SDK: Android synchronous POST credential disclosure via insecure redirect (CVE-2026-111765)","url":"https://feed.craftedsignal.io/briefs/2026-10-a2a-java-sdk-redirect/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111765","version":"https://jsonfeed.org/version/1.1"}