A vulnerability in Keycloak's token sanitization logic allows attackers with client registration privileges or a valid Initial Access Token to inject forged client roles into security tokens. This occurs because the sanitization process fails to recognize Jackson JSON objects, enabling unauthorized role mappings. Exploitation could lead to unauthorized access to protected resources. No official patch or mitigation currently meets Red Hat's criteria for ease of use and applicability.