Vendor

A2A Project

1 brief RSS

A2A Java SDK: Android synchronous POST credential disclosure via insecure redirect (CVE-2026-111765)

The A2A Java SDK for Android fails to properly disable HTTP redirects in synchronous POST requests, allowing sensitive authentication tokens to be leaked to unauthorized authorities following a 302 redirect.

a2a-java-sdk-http-client-android cve-2026-111765 vulnerability android credential-theft

1t 1c 7h ago