The default configuration for Apache Qpid 0.20 and earlier when the federation_tag attribute is enabled accepts AMQP connections without checking the source user ID which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.