Summary
A2A Java SDK can disclose configured API keys or authentication tokens when its Android HTTP client follows a cross-authority redirect. The issue becomes risky when nonstandard authentication headers are attached to a request and redirect handling sends them to a different authority.
A2A Java SDK can disclose configured API keys or authentication tokens when its Android HTTP client follows a cross-authority redirect. The issue becomes risky when nonstandard authentication headers are attached to a request and redirect handling sends them to a different authority.
Affected context
The issue affects A2A Java SDK deployments using the AndroidA2AHttpClient synchronous POST path in versions where redirect behavior can override the intended disabled-redirect setting. JSONRPCTransport and RestTransport may add authentication headers such as X-API-Key, API-Key, X-Auth-Token, or X-Authentication before the request is sent. If a redirect crosses trust or authority boundaries, Android's HTTP behavior may retain these headers and expose the configured credential to the redirected destination.
The issue affects A2A Java SDK deployments using the AndroidA2AHttpClient synchronous POST path in versions where redirect behavior can override the intended disabled-redirect setting. JSONRPCTransport and RestTransport may add authentication headers such as X-API-Key, API-Key, X-Auth-Token, or X-Authentication before the request is sent. If a redirect crosses trust or authority boundaries, Android's HTTP behavior may retain these headers and expose the configured credential to the redirected destination.
Exploit preconditions
- Attack surface: Outbound synchronous HTTP POST requests made by the Android A2A client
- Required access: Ability to influence, compromise, or otherwise control redirect behavior or the destination authority
- Trigger point: A request containing interceptor-produced authentication headers follows a cross-authority redirect
- Why exploitation is possible: The POST path can use a builder default that permits redirects, while nonstandard credential headers may be retained across the redirected request
- User interaction: Autonomous clients may issue the request without user action; user-invoked workflows may require interaction
- Attack surface: Outbound synchronous HTTP POST requests made by the Android A2A client
- Required access: Ability to influence, compromise, or otherwise control redirect behavior or the destination authority
- Trigger point: A request containing interceptor-produced authentication headers follows a cross-authority redirect
- Why exploitation is possible: The POST path can use a builder default that permits redirects, while nonstandard credential headers may be retained across the redirected request
- User interaction: Autonomous clients may issue the request without user action; user-invoked workflows may require interaction
Why this happens
The underlying bug is inconsistent redirect-policy propagation between the connection factory and the synchronous POST builder. Although one component attempts to disable redirects, the POST path can inherit a default that follows them. Because authentication interceptors add nonstandard credential headers and the HTTP client may retain those headers across authority changes, credentials are sent beyond their original trust boundary. This maps to CWE-522: Insufficiently Protected Credentials, because sensitive authentication material is exposed during transport handling.
The underlying bug is inconsistent redirect-policy propagation between the connection factory and the synchronous POST builder. Although one component attempts to disable redirects, the POST path can inherit a default that follows them. Because authentication interceptors add nonstandard credential headers and the HTTP client may retain those headers across authority changes, credentials are sent beyond their original trust boundary. This maps to CWE-522: Insufficiently Protected Credentials, because sensitive authentication material is exposed during transport handling.
Potential impact
- A configured API key or authentication token may be disclosed to another authority
- An attacker controlling a redirect target could obtain reusable application credentials
- Credentials may be exposed in logs, telemetry, or infrastructure operated by the unintended destination
- Downstream services could experience unauthorized access if the disclosed credential is accepted there
- A configured API key or authentication token may be disclosed to another authority
- An attacker controlling a redirect target could obtain reusable application credentials
- Credentials may be exposed in logs, telemetry, or infrastructure operated by the unintended destination
- Downstream services could experience unauthorized access if the disclosed credential is accepted there
General mitigation guidance
Mitigation generally focuses on making redirect handling explicit and preserving credential trust boundaries.
Common defensive patterns include:
- Disable redirects by default for authenticated requests
- Require explicit, narrowly scoped opt-in before following redirects
- Revalidate the destination authority before forwarding any credential header
- Strip authentication headers whenever a redirect changes authority, scheme, or security context
- Prefer standard credential mechanisms with well-defined redirect protections
- Limit token scope, lifetime, and privileges so disclosure has reduced impact
- Keep authentication interceptors separate from generic transport behavior and test their interaction
- Use secure transport and avoid placing credentials in requests to destinations that have not been explicitly trusted
Mitigation generally focuses on making redirect handling explicit and preserving credential trust boundaries.
Common defensive patterns include:
- Disable redirects by default for authenticated requests
- Require explicit, narrowly scoped opt-in before following redirects
- Revalidate the destination authority before forwarding any credential header
- Strip authentication headers whenever a redirect changes authority, scheme, or security context
- Prefer standard credential mechanisms with well-defined redirect protections
- Limit token scope, lifetime, and privileges so disclosure has reduced impact
- Keep authentication interceptors separate from generic transport behavior and test their interaction
- Use secure transport and avoid placing credentials in requests to destinations that have not been explicitly trusted
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying authenticated requests with redirect-following enabled
- Code review checks comparing redirect settings across connection factories, builders, and convenience methods
- Tests that verify credential headers are absent after cross-authority redirects
- Runtime policy enforcement that blocks redirects from authenticated requests unless the destination is allowlisted
- Network monitoring for API keys or token-bearing headers sent to unexpected authorities
- Dependency and automated code-review tooling that flags credential propagation across redirects
Organizations can look for this class of issue through:
- Static analysis rules identifying authenticated requests with redirect-following enabled
- Code review checks comparing redirect settings across connection factories, builders, and convenience methods
- Tests that verify credential headers are absent after cross-authority redirects
- Runtime policy enforcement that blocks redirects from authenticated requests unless the destination is allowlisted
- Network monitoring for API keys or token-bearing headers sent to unexpected authorities
- Dependency and automated code-review tooling that flags credential propagation across redirects
