AIKIDO-2026-11003

TL;DR

When Security::login() is called with a target firewall name that differs from the firewall handling the current request, the freshly minted authentication token is written to the current firewall session bucket instead of the target firewall bucket. Stateful applications with multiple firewalls can therefore persist the wrong token context, leaving the target firewall unauthenticated or exposing the target user identity and roles on the current firewall. The fix writes the token under the target firewall session key and clears _security_firewall_run so the current firewall ContextListener does not overwrite its own bucket with a foreign token.