Orgs urged to update A2A Java SDK to 1.3.2.Final to prevent custom auth header leaks during redirects

The A2A Java SDK for Android, specifically versions 1.3.0.Final and 1.3.1.Final, contains a high-severity vulnerability that exposes custom authentication credentials. The flaw, identified as CVE-2026-111765, occurs when the client follows HTTP redirects. A fix has been released in version 1.3.2.Final of the org.a2aproject.sdk:a2a-java-sdk-http-client-android package. Managed service providers should verify their dependencies immediately.

How it unfolded

• The initial fix for GHSA-9rhm added a setting to disable automatic redirects in the Android client.
• A subsequent synchronous POST builder overwrote this safety setting, re-enabling redirect following by default.
• Researchers confirmed that the overwritten setting causes the client to forward specific headers during cross-authority redirects.

Who is affected

Organisations using the A2A Java SDK for Android are at risk if they rely on versions 1.3.0.Final or 1.3.1.Final. The vulnerability impacts the AndroidA2AHttpClient component. When the client encounters a redirect to a different authority, it strips standard Authorization headers but retains nonstandard ones. This includes headers named X-API-Key, API-Key, X-Auth-Token, and X-Authentication. Attackers controlling the redirect destination can capture these synthetic or real credentials.

Our take on the response

The vendor has released version 1.3.2.Final to address the issue. Testing confirmed that explicitly disabling redirects prevents the leakage, but the default configuration in the vulnerable versions does not apply this protection. The patch restores the intended security posture by ensuring that custom authentication headers are not forwarded to unintended domains during redirect sequences.

Who needs to act first

Teams should prioritise updating systems that expose sensitive data via the A2A Java SDK for Android. Begin by identifying all applications using the vulnerable Maven package versions. Deploy the patched version in a staging environment to verify compatibility before rolling it out to production. Ensure that backup procedures are in place before applying the update. Monitor logs for any unexpected redirect behaviour during the transition period to catch potential issues early.

What to do and how to stay safe: A2A Java SDK

• Verify if your Android applications depend on A2A Java SDK versions 1.3.0.Final or 1.3.1.Final.
• Upgrade to version 1.3.2.Final once the vendor provides an update to mitigate the header leakage.
• Configure your application to explicitly disable automatic redirects if immediate patching is not possible.
• Monitor network traffic for outbound requests containing custom authentication headers to unknown domains.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific headers are leaked by this vulnerability?

The vulnerability leaks nonstandard authentication headers named X-API-Key, API-Key, X-Auth-Token, and X-Authentication during cross-authority redirects.

Is there a patch available for CVE-2026-111765?

Yes, version 1.3.2.Final of the org.a2aproject.sdk:a2a-java-sdk-http-client-android package patches the vulnerability.

How does the flaw bypass the previous fix?

The synchronous POST builder overwrites the initial setting that disabled redirects, causing the client to follow redirects and forward headers by default.