A vulnerability in the User-Managed Access (UMA) implementation of Keycloak allows an attacker to gain unauthorized access scopes on a victim's resource. This occurs when two different users own resources with the same name, and the authorization token endpoint incorrectly merges permissions from both resources during token processing.