indepth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5N_RGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.ffo7qhxjskp1

The finding correctly identifies a composite attack chain where an unauthenticated attacker exploits three independently verified weaknesses in the Artemis CORE protocol: (1) the SUBSCRIBE_TOPOLOGY_V2 handler on channel0 leaks the broker's nodeID (a type-1 UUID) without authentication, revealing the MAC address and clock sequence embedded in the UUID; (2) cluster-bridge sessions are named using type-1 UUIDs generated by the same UUIDGenerator instance with the same MAC/clock-sequence seed, making session names predictable to within ~10,000 candidates (the number of 100ns intervals per millisecond); (3) the REATTACH_SESSION handler (ActiveMQPacketHandler.handleReattachSession()) performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)