The vulnerability is an input validation flaw (CWE‑20) in Apache ActiveMQ’s TopicRegion component that allows an authenticated client to spoof the clientId when issuing a RemoveSubscription command for a durable topic subscription. By forging the clientId, an attacker can delete another user’s durable subscription, causing that user to lose guaranteed delivery of messages. The flaw does not provide code execution or network compromise but grants an unauthorized client the ability to alter subscription state and potentially disrupt message flow for other users.

Affected deployments include Apache ActiveMQ Broker, the combined Apache ActiveMQ All distribution, and the standalone Apache ActiveMQ product. The flaw exists in all versions prior to 5.19.11 and in the 6.x series before version 6.3.2. Anyone running an earlier release of either the 5.x branch or the 6.0.0‑6.3.1 releases of these products without the fix is susceptible.

The CVSS score is not publicly available, but the exploit requires only legitimate authentication to the broker and the ability to send a RemoveSubscription request. As logged‑in clients could potentially act maliciously, the threat is moderate to high. No EPSS data or KEV listing is provided, so prevalence is unknown, but an authenticated client capable of such spoofing can effectively deny service to other users by deleting their durable subscriptions.