Carlo De Wolf

The issue allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used. This occurs due to a flaw in the CallerIdentityLoginModule.

The issue allows remote attackers to gain privileges as other users due to the SecurityAssociation.getCredential method returning the credentials of the previous user when a security context is not provided.