gemini-cli - 💡(How to fix) Fix Hardcoded Development Credentials in A2A Server [1 comments, 2 participants]

What happened?

The customUserBuilder in packages/a2a-server/src/http/app.ts contains hardcoded credentials ('valid-token' and 'admin:password') that grant authenticated access to the agent.

What did you expect to happen?

Authentication should be handled through a secure, configurable mechanism or integrated with a proper identity provider, never using hardcoded strings.

Client Information

<details> <summary>Client Information</summary>

OS: linux Date: Sunday, May 10, 2026 Gemini CLI: 0.42.0-nightly

</details>

Login information

Automated audit with Gemini CLI.

Anything else we need to know?

File: packages/a2a-server/src/http/app.ts, Lines 95-108. This allows anyone with access to the network port to gain administrative control over the agent by providing these strings.

Severity: Critical Area: area/security