EEF-CVE-2026-91039 dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Summary Authentication Bypass by Spoofing vulnerability in team-alembic ashauthentication allows an attacker who operates one identity-provider connection of a dynamicoidc strategy to be signed in as a local user established through a different connection. The strategy is meant to keep each...

CVE-2026-54475

A Missing Authorization vulnerability (CWE-862) exists in Apache ActiveMQ (Broker, All, and standard versions). The issue stems from a failure to enforce isolation for Classic temporary destinations on the server side; while the client is expected to isolate these destinations to the connection t...