When Resteasy injects a SecurityContext the underlying Request is set at creation time. If this object is then used to serve a different request (e.g. when using pooled SLSB's) then the SecurityContext will be tied to the wrong request, and will return potentially incorrect data each time.

An example app that reproduces the issues is at https://issues.jboss.org/browse/AS7-3227