A2A Java let any caller read other callers' tasks; a Claude-co-authored change added task authorization only as an opt-in, so the default setup stayed open until 1.3.0.Final.

How AI contributed: Flawed AI-written codePublished Oct 20, 2026 in a2aproject/a2a-java

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

Task reads and listings had no owner check in human-written code. The AI-co-authored authorization interface, shipped in 1.1.0.Final, applied only when an application supplied a provider, so default wiring still let any caller read another caller's task status, history and artifacts. 1.3.0.Final fixes it; older lines have no patch.

AI-assisted change

Human-written code already allowed task reads and listings without owner checks. The Claude Opus 4.6 co-authored change added an authorization provider and decorator, but checks applied only when an application supplied a provider.

Root cause

Default wiring leaves task reads open

With no TaskAuthorizationProvider, the decorator leaves the provider null, and InMemoryTaskStore.list allows tasks when the provider or context is null. Any caller can read another caller's task status, history, and artifacts.

AI-assisted change: Claude

43b700a621

server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java server-common/src/main/java/org/a2aproject/sdk/server/tasks/InMemoryTaskStore.java

Fix

Fix makes task authorization fail closed

The repair removes the optional decorator path and makes DefaultRequestHandler require authorization by default through a2a.authorization.required, disabled only explicitly. Older lines remain unpatched.

Fix authorship not yet analyzed

efb4e985e9

server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java

Case facts

CVE ID: CVE-2026-111764
GHSA ID: GHSA-QW47-MCM5-934W
Published: Oct 20, 2026
Severity: Not scored
Language: Java
AI tool: Claude
AI role: Flawed AI-written code
Root cause: Authentication & access control
Vulnerable release: < 1.3.0.Final (no patched 0.3.x, 1.0.x, 1.1 or 1.2 release)
Fixed release: 1.3.0.Final

Advisory source Suggest a correction

Cite this finding

Vibe Security Radar, "CVE-2026-111764 in a2aproject/a2a-java," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-111764/

AI-assisted change

AI-assisted changeserver-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java source a2aproject/a2a-java@43b700a621+89−0

@@ -0,0 +1,254 @@+package org.a2aproject.sdk.server.requesthandlers;++import java.util.concurrent.Flow;

Show 9 hidden lines

+import java.util.concurrent.atomic.AtomicBoolean;++import jakarta.annotation.PostConstruct;+import jakarta.annotation.Priority;+import jakarta.decorator.Decorator;+import jakarta.decorator.Delegate;+import jakarta.enterprise.inject.Any;+import jakarta.enterprise.inject.Instance;+import jakarta.inject.Inject;

++import org.a2aproject.sdk.jsonrpc.common.wrappers.ListTasksResult;+import org.a2aproject.sdk.server.ServerCallContext;+import org.a2aproject.sdk.server.auth.TaskAuthorizationProvider;+import org.a2aproject.sdk.spec.A2AError;+import org.a2aproject.sdk.spec.CancelTaskParams;+import org.a2aproject.sdk.spec.DeleteTaskPushNotificationConfigParams;

Show 25 hidden lines

+import org.a2aproject.sdk.spec.EventKind;+import org.a2aproject.sdk.spec.GetTaskPushNotificationConfigParams;+import org.a2aproject.sdk.spec.ListTaskPushNotificationConfigsParams;+import org.a2aproject.sdk.spec.ListTaskPushNotificationConfigsResult;+import org.a2aproject.sdk.spec.ListTasksParams;+import org.a2aproject.sdk.spec.MessageSendParams;+import org.a2aproject.sdk.spec.StreamingEventKind;+import org.a2aproject.sdk.spec.Task;+import org.a2aproject.sdk.spec.TaskArtifactUpdateEvent;+import org.a2aproject.sdk.spec.TaskIdParams;+import org.a2aproject.sdk.spec.TaskNotFoundError;+import org.a2aproject.sdk.spec.TaskPushNotificationConfig;+import org.a2aproject.sdk.spec.TaskQueryParams;+import org.a2aproject.sdk.spec.TaskStatusUpdateEvent;+import org.a2aproject.sdk.server.auth.TaskOperation;+import org.jspecify.annotations.Nullable;++@Decorator+@Priority(50)+public class AuthorizationRequestHandlerDecorator implements RequestHandler {++    @Inject+    @Delegate+    @Any+    private RequestHandler delegate;

++    @Inject+    @Any+    Instance<TaskAuthorizationProvider> authorizationProviderInstance;++    private @Nullable TaskAuthorizationProvider authorizationProvider;++    public AuthorizationRequestHandlerDecorator() {+    }++    AuthorizationRequestHandlerDecorator(RequestHandler delegate,+            @Nullable TaskAuthorizationProvider authorizationProvider) {+        this.delegate = delegate;+        this.authorizationProvider = authorizationProvider;+    }

Show 11 hidden lines

++    @PostConstruct+    void init() {+        if (authorizationProviderInstance != null) {+            authorizationProvider = authorizationProviderInstance.isResolvable()+                    ? authorizationProviderInstance.get()+                    : null;+        }+    }++    private Flow.Publisher<StreamingEventKind> wrapPublisherForOwnership(

+            Flow.Publisher<StreamingEventKind> publisher,+            ServerCallContext context,+            TaskOperation operation,+            TaskAuthorizationProvider provider) {+        return subscriber -> publisher.subscribe(new Flow.Subscriber<>() {+            private final AtomicBoolean ownershipChecked = new AtomicBoolean(false);+            private final AtomicBoolean done = new AtomicBoolean(false);

Show 12 hidden lines

+            @SuppressWarnings("NullAway")+            private Flow.Subscription subscription;++            @Override+            public void onSubscribe(Flow.Subscription s) {+                this.subscription = s;+                subscriber.onSubscribe(s);+            }++            @Override+            public void onNext(StreamingEventKind event) {+                if (done.get()) {

This CDI decorator injects an optional TaskAuthorizationProvider and leaves it null when none is resolvable. With the default wiring, the only read check therefore has no provider and does not enforce task ownership.

AI-assisted changeserver-common/src/main/java/org/a2aproject/sdk/server/tasks/InMemoryTaskStore.java source a2aproject/a2a-java@43b700a621+26−2

@@ -6,8 +6,14 @@ import java.util.concurrent.ConcurrentMap;  import jakarta.enterprise.context.ApplicationScoped;

Show 3 hidden lines

+import jakarta.enterprise.inject.Any;+import jakarta.enterprise.inject.Instance;+import jakarta.inject.Inject;

  import org.a2aproject.sdk.jsonrpc.common.wrappers.ListTasksResult;+import org.a2aproject.sdk.server.ServerCallContext;+import org.a2aproject.sdk.server.auth.TaskAuthorizationProvider;+import org.a2aproject.sdk.server.auth.TaskOperation; import org.a2aproject.sdk.spec.Artifact; import org.a2aproject.sdk.spec.ListTasksParams;

Show 8 hidden lines

 import org.a2aproject.sdk.spec.Message;@@ -67,7 +73,7 @@  *     .statusTimestampBefore(Instant.now().minus(Duration.ofHours(48)))  *     .build();  *- * List<Task> oldTasks = taskStore.list(params).tasks();+ * List<Task> oldTasks = taskStore.list(params, context).tasks();  * oldTasks.stream()

  *     .filter(task -> task.status().state().isFinal())  *     .forEach(task -> taskStore.delete(task.id()));@@ -86,6 +92,22 @@ public class InMemoryTaskStore implements TaskStore, TaskStateProvider {      private final ConcurrentMap<String, Task> tasks = new ConcurrentHashMap<>();+    private final @Nullable TaskAuthorizationProvider authorizationProvider;++    public InMemoryTaskStore() {+        this.authorizationProvider = null;+    }++    @Inject+    public InMemoryTaskStore(@Any Instance<TaskAuthorizationProvider> authorizationProviderInstance) {+        this.authorizationProvider = authorizationProviderInstance.isResolvable()+                ? authorizationProviderInstance.get()+                : null;+    }++    InMemoryTaskStore(@Nullable TaskAuthorizationProvider authorizationProvider) {+        this.authorizationProvider = authorizationProvider;+    }

Show 20 hidden lines

     @Override     public void save(Task task, boolean isReplicated) {@@ -104,7 +126,7 @@ public void delete(String taskId) {     }      @Override-    public ListTasksResult list(ListTasksParams params) {+    public ListTasksResult list(ListTasksParams params, @Nullable ServerCallContext context) {         // Filter and sort tasks in a single stream pipeline         List<Task> allFilteredTasks = tasks.values().stream()                 .filter(task -> params.contextId() == null || params.contextId().equals(task.contextId()))@@ -114,6 +136,8 @@ public ListTasksResult list(ListTasksParams params) {                         (task.status() != null &&                          task.status().timestamp() != null &&                          task.status().timestamp().toInstant().isAfter(params.statusTimestampAfter())))+                .filter(task -> authorizationProvider == null || context == null ||+                        authorizationProvider.checkRead(context, task.id(), TaskOperation.LIST_TASKS))                 .sorted(Comparator.comparing(                         (Task t) -> (t.status() != null && t.status().timestamp() != null)                                 // Truncate to milliseconds for consistency with pageToken precision

InMemoryTaskStore stores an optional authorization provider and its list filter permits a task when the provider or call context is null. Default construction leaves the provider null, so listing can expose tasks without an owner check.

Security fix

Fixserver-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java source a2aproject/a2a-java@efb4e985e9+0−89

@@ -1,288 +0,0 @@-package org.a2aproject.sdk.server.requesthandlers;--import jakarta.annotation.PostConstruct;-import jakarta.annotation.Priority;

Show 85 hidden lines

-import jakarta.decorator.Decorator;-import jakarta.decorator.Delegate;-import jakarta.enterprise.inject.Any;-import jakarta.enterprise.inject.Instance;-import jakarta.inject.Inject;-import org.a2aproject.sdk.jsonrpc.common.wrappers.ListTasksResult;-import org.a2aproject.sdk.server.util.CdiUtils;-import org.a2aproject.sdk.server.ServerCallContext;-import org.a2aproject.sdk.server.auth.TaskAuthorizationProvider;-import org.a2aproject.sdk.server.auth.TaskOperation;-import org.a2aproject.sdk.spec.A2AError;-import org.a2aproject.sdk.spec.CancelTaskParams;-import org.a2aproject.sdk.spec.DeleteTaskPushNotificationConfigParams;-import org.a2aproject.sdk.spec.EventKind;-import org.a2aproject.sdk.spec.GetTaskPushNotificationConfigParams;-import org.a2aproject.sdk.spec.ListTaskPushNotificationConfigsParams;-import org.a2aproject.sdk.spec.ListTaskPushNotificationConfigsResult;-import org.a2aproject.sdk.spec.ListTasksParams;-import org.a2aproject.sdk.spec.Message;-import org.a2aproject.sdk.spec.MessageSendParams;-import org.a2aproject.sdk.spec.StreamingEventKind;-import org.a2aproject.sdk.spec.Task;-import org.a2aproject.sdk.spec.TaskArtifactUpdateEvent;-import org.a2aproject.sdk.spec.TaskIdParams;-import org.a2aproject.sdk.spec.TaskNotFoundError;-import org.a2aproject.sdk.spec.TaskPushNotificationConfig;-import org.a2aproject.sdk.spec.TaskQueryParams;-import org.a2aproject.sdk.spec.TaskStatusUpdateEvent;-import org.jspecify.annotations.Nullable;--import java.util.concurrent.Flow;-import java.util.concurrent.atomic.AtomicBoolean;--@Decorator-@Priority(50)-public class AuthorizationRequestHandlerDecorator implements RequestHandler {--    @Inject-    @Delegate-    @Any-    private RequestHandler delegate;--    @Inject-    @Any-    Instance<TaskAuthorizationProvider> authorizationProviderInstance;--    private @Nullable TaskAuthorizationProvider authorizationProvider;--    public AuthorizationRequestHandlerDecorator() {-    }--    /**-     * Creates an authorization decorator programmatically.-     *-     * <p>This constructor is intended for integrations with-     * non-CDI runtimes such as Spring Framework.</p>-     *-     * @param delegate              request handler being protected-     * @param authorizationProvider task authorization provider;-     *                              {@code null} disables authorization-     */-    public AuthorizationRequestHandlerDecorator(RequestHandler delegate,-            @Nullable TaskAuthorizationProvider authorizationProvider) {-        this.delegate = delegate;-        this.authorizationProvider = authorizationProvider;-    }--    @PostConstruct-    void init() {-        authorizationProvider = CdiUtils.getIfResolvable(authorizationProviderInstance);-    }--    private Flow.Publisher<StreamingEventKind> wrapPublisherForOwnership(-            Flow.Publisher<StreamingEventKind> publisher,-            ServerCallContext context,-            TaskOperation operation,-            TaskAuthorizationProvider provider) {-        return subscriber -> publisher.subscribe(new Flow.Subscriber<>() {-            private final AtomicBoolean ownershipChecked = new AtomicBoolean(false);-            private final AtomicBoolean done = new AtomicBoolean(false);-            @SuppressWarnings("NullAway")-            private Flow.Subscription subscription;--            @Override-            public void onSubscribe(Flow.Subscription s) {

Deletes the optional authorization decorator that only enforced checks when a provider was present. The repair no longer relies on this fail-open CDI path for task authorization.

Fixserver-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java source a2aproject/a2a-java@efb4e985e9+22−0

@@ -66,12 +66,14 @@ import org.a2aproject.sdk.spec.MessageSendParams; import org.a2aproject.sdk.spec.StreamingEventKind; import org.a2aproject.sdk.spec.Task;

Show 8 hidden lines

+import org.a2aproject.sdk.spec.TaskArtifactUpdateEvent; import org.a2aproject.sdk.spec.TaskIdParams; import org.a2aproject.sdk.spec.TaskNotCancelableError; import org.a2aproject.sdk.spec.TaskNotFoundError; import org.a2aproject.sdk.spec.TaskPushNotificationConfig; import org.a2aproject.sdk.spec.TaskQueryParams; import org.a2aproject.sdk.spec.TaskState;+import org.a2aproject.sdk.spec.TaskStatusUpdateEvent;

 import org.a2aproject.sdk.spec.UnsupportedOperationError; import org.a2aproject.sdk.util.Assert; import org.jspecify.annotations.NonNull;@@ -199,6 +201,7 @@ public class DefaultRequestHandler implements RequestHandler {     private static final String A2A_BLOCKING_CONSUMPTION_TIMEOUT_SECONDS = "a2a.blocking.consumption.timeout.seconds";     private static final String A2A_BLOCKING_RECONCILIATION_TIMEOUT_SECONDS = "a2a.blocking.reconciliation.timeout.seconds";     private static final String A2A_REQUEST_CONTEXT_POPULATE_REFERRED_TASKS = "a2a.request-context.populate-referred-tasks";+    private static final String A2A_AUTHORIZATION_REQUIRED = "a2a.authorization.required";      @Inject     A2AConfigProvider configProvider;@@ -216,8 +219,12 @@ public class DefaultRequestHandler implements RequestHandler {     @Nullable Instance<AgentExecutorRouter> agentExecutorRouterInstance;      private @Nullable TaskAuthorizationProvider authorizationProvider;+     private @Nullable AgentExecutorRouter agentExecutorRouter; +    private boolean authorizationRequired = true;++     /**

Show 3 hidden lines

      * Timeout in seconds to wait for agent execution to complete in blocking calls.      * This allows slow agents (LLM-based, data processing, external APIs) sufficient time.@@ -332,6 +339,8 @@ void initConfig() {

         agentExecutorRouter = CdiUtils.getIfResolvable(agentExecutorRouterInstance);         boolean populateReferredTasks = Boolean.parseBoolean(                 configProvider.getValue(A2A_REQUEST_CONTEXT_POPULATE_REFERRED_TASKS));+        this.authorizationRequired = Boolean.parseBoolean(+                configProvider.getValue(A2A_AUTHORIZATION_REQUIRED));         this.requestContextBuilder = () -> new SimpleRequestContextBuilder(taskStore, populateReferredTasks, authorizationProvider);     }

Show 2 hidden lines

 @@ -351,6 +360,7 @@ public static class Builder {

         private Executor eventConsumerExecutor;         private @Nullable TaskAuthorizationProvider authorizationProvider;         private @Nullable AgentExecutorRouter agentExecutorRouter;+        private boolean authorizationRequired = true;         private boolean populateReferredTasks;          public Builder agentExecutor(AgentExecutor agentExecutor) {

Show 1 hidden lines

@@ -404,6 +414,11 @@ public Builder agentExecutorRouter(@Nullable AgentExecutorRouter agentExecutorRo

             return this;         } +        public Builder authorizationRequired(boolean authorizationRequired) {+            this.authorizationRequired = authorizationRequired;+            return this;+        }+         public Builder populateReferredTasks(boolean populateReferredTasks) {             this.populateReferredTasks = populateReferredTasks;             return this;@@ -425,6 +440,7 @@ public DefaultRequestHandler build() {             handler.reconciliationTimeoutSeconds = 1;             handler.authorizationProvider = authorizationProvider;             handler.agentExecutorRouter = agentExecutorRouter;+            handler.authorizationRequired = authorizationRequired;             handler.requestContextBuilder =                     () -> new SimpleRequestContextBuilder(taskStore, populateReferredTasks, authorizationProvider);             return handler;@@ -434,6 +450,7 @@ public DefaultRequestHandler build() {     @Override     public Task onGetTask(TaskQueryParams params, ServerCallContext context) throws A2AError {         LOGGER.debug("onGetTask {}", params.id());

Show 9 hidden lines

+        enforceRead(context, params.id(), TaskOperation.GET_TASK);         Task task = taskStore.get(params.id());         if (task == null) {             LOGGER.debug("No task found for {}. Throwing TaskNotFoundError", params.id());@@ -466,8 +483,79 @@ private static Task limitTaskHistory(Task task, @Nullable Integer historyLength)                 .build();     } +    private static final String LIST_TASKS_SCOPE_ID = "";

++    private void enforceRead(ServerCallContext context, String taskId, TaskOperation operation) throws A2AError {+        if (authorizationProvider == null) {+            if (authorizationRequired) {

DefaultRequestHandler now defaults authorizationRequired to true and reads a2a.authorization.required during initialization. This makes task authorization fail closed unless an application explicitly disables the requirement.

Patch fingerprints

AI-assisted change ed7b57e98bcfd3f211623583a7b5e845989db7419225663cc3eb6bfff9cb2071 · Fix e5504f568b603b774790c000d981ea3e0faa5b85d0a06c436ea7498b99a2248f

All 89 →

Leantime's JSON-RPC exposed API-key creation without authorization; a Claude-co-authored refactor added the createApiKeyWithProjects method the advisory names, letting any logged-in user mint an admin key.
CVE-2026-85990Oct 15, 2026Leantime/leantimePHPClaudeFlawed AI-written codeAuthentication & access control
A change committed through Vikunja's LLM-assisted bot let an inherited admin grant override a lower permission on a child project, so restricted users kept admin access in 2.6.0.
GHSA-PJR3-86V4-5P7WOct 9, 2026go-vikunja/vikunjaGoUnidentified AI toolDirect introductionAuthentication & access control
The Claude-assisted first release of this payment gate trusted a client-supplied credential source and granted access without verifying it, so anyone naming a qualifying wallet got paid content.
CVE-2026-104891Oct 7, 2026douglasborthwick-crypto/mppx-condition-gateJavaScriptClaudeDirect introductionAuthentication & access control
PraisonAI added an agent-invocation route without enforcing the configured API key. The repair installs shared authentication middleware on the application.
HighCVE-2026-55538Aug 25, 2026mervinpraison/praisonaiPythonUnidentified AI toolFlawed AI-written codeAuthentication & access control
AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change. Version 4.5.1 adds an administrator check for user listing only. Dashboard and log-stream exposure remains in the inspected source revision; no complete advisory repair or binary equivalence is established.
CVE-2026-79665Aug 25, 2026lin-snow/ech0GoCursorFlawed AI-written codeAuthentication & access control

A2A Java let any caller read other callers' tasks; a Claude-co-authored change added task authorization only as an opt-in, so the default setup stayed open until 1.3.0.Final.

How AI contributed: Flawed AI-written codePublished Oct 20, 2026 in a2aproject/a2a-java

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

AI-assisted change

Root cause

Default wiring leaves task reads open

AI-assisted change: Claude

43b700a621

server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java server-common/src/main/java/org/a2aproject/sdk/server/tasks/InMemoryTaskStore.java

Fix

Fix makes task authorization fail closed

Fix authorship not yet analyzed

efb4e985e9

Case facts

CVE ID: CVE-2026-111764
GHSA ID: GHSA-QW47-MCM5-934W
Published: Oct 20, 2026
Severity: Not scored
Language: Java
AI tool: Claude
AI role: Flawed AI-written code
Root cause: Authentication & access control
Vulnerable release: < 1.3.0.Final (no patched 0.3.x, 1.0.x, 1.1 or 1.2 release)
Fixed release: 1.3.0.Final

Advisory source Suggest a correction

Cite this finding

Vibe Security Radar, "CVE-2026-111764 in a2aproject/a2a-java," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-111764/

AI-assisted change

AI-assisted changeserver-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java source a2aproject/a2a-java@43b700a621+89−0

@@ -0,0 +1,254 @@+package org.a2aproject.sdk.server.requesthandlers;++import java.util.concurrent.Flow;

Show 9 hidden lines

+import java.util.concurrent.atomic.AtomicBoolean;++import jakarta.annotation.PostConstruct;+import jakarta.annotation.Priority;+import jakarta.decorator.Decorator;+import jakarta.decorator.Delegate;+import jakarta.enterprise.inject.Any;+import jakarta.enterprise.inject.Instance;+import jakarta.inject.Inject;

++import org.a2aproject.sdk.jsonrpc.common.wrappers.ListTasksResult;+import org.a2aproject.sdk.server.ServerCallContext;+import org.a2aproject.sdk.server.auth.TaskAuthorizationProvider;+import org.a2aproject.sdk.spec.A2AError;+import org.a2aproject.sdk.spec.CancelTaskParams;+import org.a2aproject.sdk.spec.DeleteTaskPushNotificationConfigParams;

Show 25 hidden lines

+import org.a2aproject.sdk.spec.EventKind;+import org.a2aproject.sdk.spec.GetTaskPushNotificationConfigParams;+import org.a2aproject.sdk.spec.ListTaskPushNotificationConfigsParams;+import org.a2aproject.sdk.spec.ListTaskPushNotificationConfigsResult;+import org.a2aproject.sdk.spec.ListTasksParams;+import org.a2aproject.sdk.spec.MessageSendParams;+import org.a2aproject.sdk.spec.StreamingEventKind;+import org.a2aproject.sdk.spec.Task;+import org.a2aproject.sdk.spec.TaskArtifactUpdateEvent;+import org.a2aproject.sdk.spec.TaskIdParams;+import org.a2aproject.sdk.spec.TaskNotFoundError;+import org.a2aproject.sdk.spec.TaskPushNotificationConfig;+import org.a2aproject.sdk.spec.TaskQueryParams;+import org.a2aproject.sdk.spec.TaskStatusUpdateEvent;+import org.a2aproject.sdk.server.auth.TaskOperation;+import org.jspecify.annotations.Nullable;++@Decorator+@Priority(50)+public class AuthorizationRequestHandlerDecorator implements RequestHandler {++    @Inject+    @Delegate+    @Any+    private RequestHandler delegate;

++    @Inject+    @Any+    Instance<TaskAuthorizationProvider> authorizationProviderInstance;++    private @Nullable TaskAuthorizationProvider authorizationProvider;++    public AuthorizationRequestHandlerDecorator() {+    }++    AuthorizationRequestHandlerDecorator(RequestHandler delegate,+            @Nullable TaskAuthorizationProvider authorizationProvider) {+        this.delegate = delegate;+        this.authorizationProvider = authorizationProvider;+    }

Show 11 hidden lines

++    @PostConstruct+    void init() {+        if (authorizationProviderInstance != null) {+            authorizationProvider = authorizationProviderInstance.isResolvable()+                    ? authorizationProviderInstance.get()+                    : null;+        }+    }++    private Flow.Publisher<StreamingEventKind> wrapPublisherForOwnership(

+            Flow.Publisher<StreamingEventKind> publisher,+            ServerCallContext context,+            TaskOperation operation,+            TaskAuthorizationProvider provider) {+        return subscriber -> publisher.subscribe(new Flow.Subscriber<>() {+            private final AtomicBoolean ownershipChecked = new AtomicBoolean(false);+            private final AtomicBoolean done = new AtomicBoolean(false);

Show 12 hidden lines

+            @SuppressWarnings("NullAway")+            private Flow.Subscription subscription;++            @Override+            public void onSubscribe(Flow.Subscription s) {+                this.subscription = s;+                subscriber.onSubscribe(s);+            }++            @Override+            public void onNext(StreamingEventKind event) {+                if (done.get()) {

AI-assisted changeserver-common/src/main/java/org/a2aproject/sdk/server/tasks/InMemoryTaskStore.java source a2aproject/a2a-java@43b700a621+26−2

@@ -6,8 +6,14 @@ import java.util.concurrent.ConcurrentMap;  import jakarta.enterprise.context.ApplicationScoped;

Show 3 hidden lines

+import jakarta.enterprise.inject.Any;+import jakarta.enterprise.inject.Instance;+import jakarta.inject.Inject;

  import org.a2aproject.sdk.jsonrpc.common.wrappers.ListTasksResult;+import org.a2aproject.sdk.server.ServerCallContext;+import org.a2aproject.sdk.server.auth.TaskAuthorizationProvider;+import org.a2aproject.sdk.server.auth.TaskOperation; import org.a2aproject.sdk.spec.Artifact; import org.a2aproject.sdk.spec.ListTasksParams;

Show 8 hidden lines

 import org.a2aproject.sdk.spec.Message;@@ -67,7 +73,7 @@  *     .statusTimestampBefore(Instant.now().minus(Duration.ofHours(48)))  *     .build();  *- * List<Task> oldTasks = taskStore.list(params).tasks();+ * List<Task> oldTasks = taskStore.list(params, context).tasks();  * oldTasks.stream()

  *     .filter(task -> task.status().state().isFinal())  *     .forEach(task -> taskStore.delete(task.id()));@@ -86,6 +92,22 @@ public class InMemoryTaskStore implements TaskStore, TaskStateProvider {      private final ConcurrentMap<String, Task> tasks = new ConcurrentHashMap<>();+    private final @Nullable TaskAuthorizationProvider authorizationProvider;++    public InMemoryTaskStore() {+        this.authorizationProvider = null;+    }++    @Inject+    public InMemoryTaskStore(@Any Instance<TaskAuthorizationProvider> authorizationProviderInstance) {+        this.authorizationProvider = authorizationProviderInstance.isResolvable()+                ? authorizationProviderInstance.get()+                : null;+    }++    InMemoryTaskStore(@Nullable TaskAuthorizationProvider authorizationProvider) {+        this.authorizationProvider = authorizationProvider;+    }

Show 20 hidden lines

     @Override     public void save(Task task, boolean isReplicated) {@@ -104,7 +126,7 @@ public void delete(String taskId) {     }      @Override-    public ListTasksResult list(ListTasksParams params) {+    public ListTasksResult list(ListTasksParams params, @Nullable ServerCallContext context) {         // Filter and sort tasks in a single stream pipeline         List<Task> allFilteredTasks = tasks.values().stream()                 .filter(task -> params.contextId() == null || params.contextId().equals(task.contextId()))@@ -114,6 +136,8 @@ public ListTasksResult list(ListTasksParams params) {                         (task.status() != null &&                          task.status().timestamp() != null &&                          task.status().timestamp().toInstant().isAfter(params.statusTimestampAfter())))+                .filter(task -> authorizationProvider == null || context == null ||+                        authorizationProvider.checkRead(context, task.id(), TaskOperation.LIST_TASKS))                 .sorted(Comparator.comparing(                         (Task t) -> (t.status() != null && t.status().timestamp() != null)                                 // Truncate to milliseconds for consistency with pageToken precision

Security fix

Fixserver-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java source a2aproject/a2a-java@efb4e985e9+0−89

@@ -1,288 +0,0 @@-package org.a2aproject.sdk.server.requesthandlers;--import jakarta.annotation.PostConstruct;-import jakarta.annotation.Priority;

Show 85 hidden lines

-import jakarta.decorator.Decorator;-import jakarta.decorator.Delegate;-import jakarta.enterprise.inject.Any;-import jakarta.enterprise.inject.Instance;-import jakarta.inject.Inject;-import org.a2aproject.sdk.jsonrpc.common.wrappers.ListTasksResult;-import org.a2aproject.sdk.server.util.CdiUtils;-import org.a2aproject.sdk.server.ServerCallContext;-import org.a2aproject.sdk.server.auth.TaskAuthorizationProvider;-import org.a2aproject.sdk.server.auth.TaskOperation;-import org.a2aproject.sdk.spec.A2AError;-import org.a2aproject.sdk.spec.CancelTaskParams;-import org.a2aproject.sdk.spec.DeleteTaskPushNotificationConfigParams;-import org.a2aproject.sdk.spec.EventKind;-import org.a2aproject.sdk.spec.GetTaskPushNotificationConfigParams;-import org.a2aproject.sdk.spec.ListTaskPushNotificationConfigsParams;-import org.a2aproject.sdk.spec.ListTaskPushNotificationConfigsResult;-import org.a2aproject.sdk.spec.ListTasksParams;-import org.a2aproject.sdk.spec.Message;-import org.a2aproject.sdk.spec.MessageSendParams;-import org.a2aproject.sdk.spec.StreamingEventKind;-import org.a2aproject.sdk.spec.Task;-import org.a2aproject.sdk.spec.TaskArtifactUpdateEvent;-import org.a2aproject.sdk.spec.TaskIdParams;-import org.a2aproject.sdk.spec.TaskNotFoundError;-import org.a2aproject.sdk.spec.TaskPushNotificationConfig;-import org.a2aproject.sdk.spec.TaskQueryParams;-import org.a2aproject.sdk.spec.TaskStatusUpdateEvent;-import org.jspecify.annotations.Nullable;--import java.util.concurrent.Flow;-import java.util.concurrent.atomic.AtomicBoolean;--@Decorator-@Priority(50)-public class AuthorizationRequestHandlerDecorator implements RequestHandler {--    @Inject-    @Delegate-    @Any-    private RequestHandler delegate;--    @Inject-    @Any-    Instance<TaskAuthorizationProvider> authorizationProviderInstance;--    private @Nullable TaskAuthorizationProvider authorizationProvider;--    public AuthorizationRequestHandlerDecorator() {-    }--    /**-     * Creates an authorization decorator programmatically.-     *-     * <p>This constructor is intended for integrations with-     * non-CDI runtimes such as Spring Framework.</p>-     *-     * @param delegate              request handler being protected-     * @param authorizationProvider task authorization provider;-     *                              {@code null} disables authorization-     */-    public AuthorizationRequestHandlerDecorator(RequestHandler delegate,-            @Nullable TaskAuthorizationProvider authorizationProvider) {-        this.delegate = delegate;-        this.authorizationProvider = authorizationProvider;-    }--    @PostConstruct-    void init() {-        authorizationProvider = CdiUtils.getIfResolvable(authorizationProviderInstance);-    }--    private Flow.Publisher<StreamingEventKind> wrapPublisherForOwnership(-            Flow.Publisher<StreamingEventKind> publisher,-            ServerCallContext context,-            TaskOperation operation,-            TaskAuthorizationProvider provider) {-        return subscriber -> publisher.subscribe(new Flow.Subscriber<>() {-            private final AtomicBoolean ownershipChecked = new AtomicBoolean(false);-            private final AtomicBoolean done = new AtomicBoolean(false);-            @SuppressWarnings("NullAway")-            private Flow.Subscription subscription;--            @Override-            public void onSubscribe(Flow.Subscription s) {

Deletes the optional authorization decorator that only enforced checks when a provider was present. The repair no longer relies on this fail-open CDI path for task authorization.

Fixserver-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java source a2aproject/a2a-java@efb4e985e9+22−0

@@ -66,12 +66,14 @@ import org.a2aproject.sdk.spec.MessageSendParams; import org.a2aproject.sdk.spec.StreamingEventKind; import org.a2aproject.sdk.spec.Task;

Show 8 hidden lines

+import org.a2aproject.sdk.spec.TaskArtifactUpdateEvent; import org.a2aproject.sdk.spec.TaskIdParams; import org.a2aproject.sdk.spec.TaskNotCancelableError; import org.a2aproject.sdk.spec.TaskNotFoundError; import org.a2aproject.sdk.spec.TaskPushNotificationConfig; import org.a2aproject.sdk.spec.TaskQueryParams; import org.a2aproject.sdk.spec.TaskState;+import org.a2aproject.sdk.spec.TaskStatusUpdateEvent;

 import org.a2aproject.sdk.spec.UnsupportedOperationError; import org.a2aproject.sdk.util.Assert; import org.jspecify.annotations.NonNull;@@ -199,6 +201,7 @@ public class DefaultRequestHandler implements RequestHandler {     private static final String A2A_BLOCKING_CONSUMPTION_TIMEOUT_SECONDS = "a2a.blocking.consumption.timeout.seconds";     private static final String A2A_BLOCKING_RECONCILIATION_TIMEOUT_SECONDS = "a2a.blocking.reconciliation.timeout.seconds";     private static final String A2A_REQUEST_CONTEXT_POPULATE_REFERRED_TASKS = "a2a.request-context.populate-referred-tasks";+    private static final String A2A_AUTHORIZATION_REQUIRED = "a2a.authorization.required";      @Inject     A2AConfigProvider configProvider;@@ -216,8 +219,12 @@ public class DefaultRequestHandler implements RequestHandler {     @Nullable Instance<AgentExecutorRouter> agentExecutorRouterInstance;      private @Nullable TaskAuthorizationProvider authorizationProvider;+     private @Nullable AgentExecutorRouter agentExecutorRouter; +    private boolean authorizationRequired = true;++     /**

Show 3 hidden lines

      * Timeout in seconds to wait for agent execution to complete in blocking calls.      * This allows slow agents (LLM-based, data processing, external APIs) sufficient time.@@ -332,6 +339,8 @@ void initConfig() {

         agentExecutorRouter = CdiUtils.getIfResolvable(agentExecutorRouterInstance);         boolean populateReferredTasks = Boolean.parseBoolean(                 configProvider.getValue(A2A_REQUEST_CONTEXT_POPULATE_REFERRED_TASKS));+        this.authorizationRequired = Boolean.parseBoolean(+                configProvider.getValue(A2A_AUTHORIZATION_REQUIRED));         this.requestContextBuilder = () -> new SimpleRequestContextBuilder(taskStore, populateReferredTasks, authorizationProvider);     }

Show 2 hidden lines

 @@ -351,6 +360,7 @@ public static class Builder {

         private Executor eventConsumerExecutor;         private @Nullable TaskAuthorizationProvider authorizationProvider;         private @Nullable AgentExecutorRouter agentExecutorRouter;+        private boolean authorizationRequired = true;         private boolean populateReferredTasks;          public Builder agentExecutor(AgentExecutor agentExecutor) {

Show 1 hidden lines

@@ -404,6 +414,11 @@ public Builder agentExecutorRouter(@Nullable AgentExecutorRouter agentExecutorRo

             return this;         } +        public Builder authorizationRequired(boolean authorizationRequired) {+            this.authorizationRequired = authorizationRequired;+            return this;+        }+         public Builder populateReferredTasks(boolean populateReferredTasks) {             this.populateReferredTasks = populateReferredTasks;             return this;@@ -425,6 +440,7 @@ public DefaultRequestHandler build() {             handler.reconciliationTimeoutSeconds = 1;             handler.authorizationProvider = authorizationProvider;             handler.agentExecutorRouter = agentExecutorRouter;+            handler.authorizationRequired = authorizationRequired;             handler.requestContextBuilder =                     () -> new SimpleRequestContextBuilder(taskStore, populateReferredTasks, authorizationProvider);             return handler;@@ -434,6 +450,7 @@ public DefaultRequestHandler build() {     @Override     public Task onGetTask(TaskQueryParams params, ServerCallContext context) throws A2AError {         LOGGER.debug("onGetTask {}", params.id());

Show 9 hidden lines

+        enforceRead(context, params.id(), TaskOperation.GET_TASK);         Task task = taskStore.get(params.id());         if (task == null) {             LOGGER.debug("No task found for {}. Throwing TaskNotFoundError", params.id());@@ -466,8 +483,79 @@ private static Task limitTaskHistory(Task task, @Nullable Integer historyLength)                 .build();     } +    private static final String LIST_TASKS_SCOPE_ID = "";

++    private void enforceRead(ServerCallContext context, String taskId, TaskOperation operation) throws A2AError {+        if (authorizationProvider == null) {+            if (authorizationRequired) {

Patch fingerprints

AI-assisted change ed7b57e98bcfd3f211623583a7b5e845989db7419225663cc3eb6bfff9cb2071 · Fix e5504f568b603b774790c000d981ea3e0faa5b85d0a06c436ea7498b99a2248f

All 89 →

Leantime's JSON-RPC exposed API-key creation without authorization; a Claude-co-authored refactor added the createApiKeyWithProjects method the advisory names, letting any logged-in user mint an admin key.
CVE-2026-85990Oct 15, 2026Leantime/leantimePHPClaudeFlawed AI-written codeAuthentication & access control
A change committed through Vikunja's LLM-assisted bot let an inherited admin grant override a lower permission on a child project, so restricted users kept admin access in 2.6.0.
GHSA-PJR3-86V4-5P7WOct 9, 2026go-vikunja/vikunjaGoUnidentified AI toolDirect introductionAuthentication & access control
The Claude-assisted first release of this payment gate trusted a client-supplied credential source and granted access without verifying it, so anyone naming a qualifying wallet got paid content.
CVE-2026-104891Oct 7, 2026douglasborthwick-crypto/mppx-condition-gateJavaScriptClaudeDirect introductionAuthentication & access control
PraisonAI added an agent-invocation route without enforcing the configured API key. The repair installs shared authentication middleware on the application.
HighCVE-2026-55538Aug 25, 2026mervinpraison/praisonaiPythonUnidentified AI toolFlawed AI-written codeAuthentication & access control
AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change. Version 4.5.1 adds an administrator check for user listing only. Dashboard and log-stream exposure remains in the inspected source revision; no complete advisory repair or binary equivalence is established.
CVE-2026-79665Aug 25, 2026lin-snow/ech0GoCursorFlawed AI-written codeAuthentication & access control

A2A Java let any caller read other callers' tasks; a Claude-co-authored change added task authorization only as an opt-in, so the default setup stayed open until 1.3.0.Final.

Default wiring leaves task reads open

Fix makes task authorization fail closed

AI-assisted change

Security fix

More Authentication & access control findings

A2A Java let any caller read other callers' tasks; a Claude-co-authored change added task authorization only as an opt-in, so the default setup stayed open until 1.3.0.Final.

Default wiring leaves task reads open

Fix makes task authorization fail closed

AI-assisted change

Security fix

More Authentication & access control findings