It seems we hit an issue somewhere in a token management subsystem. The issue description is a bit confusion, but here are the steps to reproduce:

1. Generate access/refresh token pair with a short lifetime (used 15s in my tests)
2. Wait till access token expires
3. Simultaneously send two refresh token requests
4. When first request completes try to use newly refresh token within a request to _authenticate endpoint

It happens so that at the step 4. first refresh request is still in progress and request to _authenticate with newly refreshed token at the same time fails with the following error:

HTTP/1.1 401 Unauthorized (application/json)
WWW-Authenticate: Bearer realm="security"
WWW-Authenticate: ApiKey
WWW-Authenticate: Basic realm="security" charset="UTF-8"

{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/_security/_authenticate]","header":{"WWW-Authenticate":["Bearer realm="security"","ApiKey","Basic realm="security" charset="UTF-8""]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/_security/_authenticate]","header":{"WWW-Authenticate":["Bearer realm="security"","ApiKey","Basic realm="security"

/cc @jkakavas