CVE-2026-90820
a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such manipulation leads to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 is sufficient to resolve this issue. The name of the patch is e9a1abf9c90c02b16d17293afdc3cc2f555d63a6. The affected component should be upgraded.
| CWE | CWE-862 CWE-863 |
| Vendor | a2aproject |
| Product | a2a-java |
| Published | Sep 14, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for a2aproject a2a-java
Be the first to know when new medium vulnerabilities affecting a2aproject a2a-java are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
a2aproject / a2a-java
1.2.0
References
vuldb.com: https://vuldb.com/vuln/403323 vuldb.com: https://vuldb.com/vuln/403323/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90820 vuldb.com: https://vuldb.com/submit/925152 github.com: https://github.com/a2aproject/a2a-java/pull/1038 github.com: https://github.com/a2aproject/a2a-java/commit/e9a1abf9c90c02b16d17293afdc3cc2f555d63a6 github.com: https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final github.com: https://github.com/a2aproject/a2a-java/
Credits
🔍 colorfullbz (VulDB User)