CVE-2026-90820Medium· 4.3▾ SunlitA security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandl…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.4%
A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such manipulation leads to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 is sufficient to resolve this issue. The name of the patch is e9a1abf9c90c02b16d17293afdc3cc2f555d63a6. The affected component should be upgraded.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117507Medium· 5.4a2aproject a2a-java TaskManager.saveTaskEvent race condition
CVE-2026-117506Medium· 4.3a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
CVE-2026-117505Medium· 4.3a2aproject a2a-java ChildQueue queue.offer resource consumption
CVE-2026-116479Medium· 4.3a2aproject a2a-java JSON-RPC Error getMessage information exposure
CVE-2026-90819High· 7.3A weakness has been identified in a2aproject a2a-java 1.2.0
CVE-2026-111763Medium· 5.7A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect