What happened
In the official A2A (Agent2Agent) Java SDK prior to 1.3.0.Final, AuthInterceptor.intercept uses the remote AgentCard's APIKeySecurityScheme.name() directly as the HTTP header name holding the credential, without checking the declared location is HEADER. JdkA2AHttpClient follows redirects (NORMAL), so a malicious or compromised remote agent can cause the client to forward a configured API key to a third-party server via a cross-origin redirect even when the standard Authorization header is stripped.
Why it matters
The failure lets an agent the client is already talking to steal the API key configured for that agent by steering a redirect. In agent-to-agent deployments where credentials are supplied via CredentialService, an untrusted downstream agent can harvest the client's secret and use it against the intended service, defeating the assumption that the key stays with the configured agent.
Attack vector
Agent-controlled AgentCard + cross-origin redirect forwards the custom credential-bearing header to a third-party server
Affected systems
a2a-java (A2A Java SDK) < 1.3.0.Final
Mitigation
Upgrade to a2a-java 1.3.0.Final; validate the security-scheme location is HEADER and limit redirect following