A vulnerability in the Pushed Authorization Request (PAR) implementation of the keycloak-services component allows reuse of a single-use authorization request. When an authentication flow is restarted, internal markers tracking PAR consumption are incorrectly cleared while the request remains active. This flaw enables an attacker with valid client credentials to obtain multiple access tokens from the same authorization request, bypassing the intended single-use restriction.