The code that checks whether a client id is already logged in is not thread safe.

org.jboss.mq.sm.AbstractStateManager

public void addLoggedOnClientId(String ID) throws JMSException
{

// CHECK NOT ALREADY PRESENT

synchronized (loggedOnClientIds)

{ if (loggedOnClientIds.contains(ID)) throw new InvalidClientIDException("This client id '" + ID + "' is already registered!"); }

// CHECK THIS CLIENT ID IS ALLOWED TO BE SET MANUALLY

checkLoggedOnClientId(ID);

// REGISTER THE CLIENT ID

synchronized (loggedOnClientIds)

{ loggedOnClientIds.add(ID); }

if (log.isTraceEnabled())
log.trace("Client id '" + ID + "' is logged in.");
}

The two synchronized blocks need combining into one block after we have checked whether
the client id is password protected.