A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

GHSA-4FPJ-G9JF-9RGG A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

Agent2Agent A2A Java SDK Trust Management Vulnerability

The Agent2Agent A2A Java SDK versions from 1.3.0.Final to 1.3.2.Final contain a trust management issue. This issue arises because the AndroidA2AHttpClient’s synchronous POST path overrides the disabled redirection settings. Additionally, JSONRPCTransport and RestTransport send synchronous request...