When MDB's connection thread (Connection Consumer Thread) receive a message, JMSSecurityException is throwed on rare occasions. And the thread go down, so MDB don't be executed if a message be sent.

Following stacktrace is visible in server.log.

10:39:15,796 WARN [SpyConnectionConsumer] Connection consumer closing due to error in listening thread SpyConnectionConsumer[sub=Subscription[subId=-2147483648connection=ConnectionToken:ID:1/a347321b2793ca494842452c5278a657 destination=TOPIC.testTopic messageSelector=null Local Create] messages=0 waitingForMessage=false internalThread=Thread[Connection Consumer for dest Subscription[subId=-2147483648connection=ConnectionToken:ID:1/a347321b2793ca494842452c5278a657 destination=TOPIC.testTopic messageSelector=null Local Create] id=1,5,jboss] sessionPool=org.jboss.jms.asf.StdServerSessionPool@1ce9085 connection=Connection@13008985[token=ConnectionToken:ID:1/a347321b2793ca494842452c5278a657 rcvstate=STARTED]]
javax.jms.JMSSecurityException: User session is not valid
at org.jboss.mq.security.SecurityManager.authorize(SecurityManager.java:230)
at org.jboss.mq.security.ServerSecurityInterceptor.authorizeRead(ServerSecurityInterceptor.java:233)
at org.jboss.mq.security.ServerSecurityInterceptor.receive(ServerSecurityInterceptor.java:98)
at org.jboss.mq.server.TracingInterceptor.receive(TracingInterceptor.java:570)
at org.jboss.mq.server.JMSServerInvoker.receive(JMSServerInvoker.java:226)
at org.jboss.mq.il.jvm.JVMServerIL.receive(JVMServerIL.java:244)
at org.jboss.mq.Connection.receive(Connection.java:909)
at org.jboss.mq.SpyConnectionConsumer.run(SpyConnectionConsumer.java:238)
at java.lang.Thread.run(Thread.java:534)

It looks like a synchronization problem.
In 'org.jboss.mq.security.SecurityManager#authorize' method, 'authCache' variable is accessed by HashMap#get method but it's not synchronized.
When other thread put object to the 'authCache' variable, the HashMap#get methos will return null on rare occasions even though the key is contained.
so when the return value is null, JMSSecurityException is throwed.

SubjectInfo info = (SubjectInfo) authCache.get(token.getSessionId());
if (info == null)
throw new JMSSecurityException("User session is not valid");

I wrote a patch for JBossAS Branch_4_0 and Branch_4_2.
It is very simple patch that add synchorized block.