Executive brief
Apache ActiveMQ is a widely-used open-source message broker that handles communication between enterprise applications. An authenticated attacker can spoof the client identity when removing durable topic subscriptions, potentially allowing them to interfere with other users' subscriptions or subscriptions belonging to other applications sharing the same broker.
Technical details
The vulnerability is an improper input validation flaw in the TopicRegion component of Apache ActiveMQ. An authenticated client can forge or spoof a clientId parameter when removing a durable topic subscription, bypassing identity verification controls. This requires prior authentication to the broker but no elevated privileges. An attacker with broker access could disrupt legitimate subscriptions, remove subscriptions belonging to other clients, or interfere with message delivery patterns. The issue affects ActiveMQ versions before 5.19.11 and 6.0.0 through 6.3.1; patched versions 5.19.11 and 6.3.2 are available.
Affected products
- Apache ActiveMQ before 5.19.11, 6.0.0 through 6.3.1
- Apache ActiveMQ Broker before 5.19.11, 6.0.0 through 6.3.1
Timeline
- 2026-09-09: disclosed