An improper input validation vulnerability in Apache ActiveMQ and Apache ActiveMQ KahaDB allows authenticated clients to spoof other users' connection, session, and consumer IDs. This enables unauthorized consumption from another user's temporary queues or topics, disruption of live subscriptions by tearing them down, and permanent deletion of in-flight, unacknowledged messages via forged acknowledgments. The issue affects versions from 6.0.0 before 6.3.3 and before 5.19.12. Fixed versions are 6.4.0, 6.3.3, and 5.19.12.