# A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

A2A Java SDK Android client's synchronous POST re-enables redirects, forwarding API keys in nonstandard auth headers to a different authority.

- Payout: Research
- Severity: high
- Program: A2A Java SDK
- Found by: north-echo
- Disclosed: 2026-10-20
- CVE: CVE-2026-111765
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-4fpj-g9jf-9rgg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-4fpj-g9jf-9rgg
- Tags: area:mobile domain:mobile domain:oss impact:data-leak kind:research platform:ghsa sev:high tech:android tech:java technique:incomplete-fix technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Android HTTP client (AndroidA2AHttpClient) synchronous POST
**Root cause:** The parent fix set setInstanceFollowRedirects(false) in createConnection(), but the POST builder overwrites it with a field defaulting to true; Android's repackaged OkHttp strips Authorization on cross-authority redirects but retains nonstandard headers like X-API-Key.
**Steps:**
1. Note createConnection() sets `connection.setInstanceFollowRedirects(false)`
2. Observe post() calls `connection.setInstanceFollowRedirects(followRedirects)` where `private boolean followRedirects = true;`
3. Configure AuthInterceptor with a credential in `X-API-Key`/`API-Key`/`X-Auth-Token`/`X-Authentication`
4. Send synchronous POST to an attacker endpoint returning a 302 to a second authority
5. Observe the collector receives the full credential header (status=200) while Authorization is null
6. Control: explicitly `followRedirects(false)` returns 302 with collectorHits=0
**How found:** Reviewed the parent GHSA-9rhm fix, noticed the safe no-redirect setting in createConnection() was contradicted by a later POST-level assignment defaulting to true; traced interceptor header injection and Android OkHttp redirect header-stripping behavior, then built a loopback fixture to confirm forwarding.
**Exploitation:** A malicious or compromised remote agent returns a cross-authority redirect to the Android client's synchronous POST; the client follows it and forwards the configured API key/token header to the second authority, disclosing the credential.
**Insight:** When a fix disables a dangerous default in a shared helper, grep every call site for later re-assignment of the same property; Android's OkHttp only strips Authorization on cross-authority redirects, so nonstandard auth header names survive.