A vulnerability in the SAML identity broker component of Keycloak allows an attacker to replay a valid signed assertion without possessing the associated private key, leading to unauthorized access and user impersonation. The flaw stems from the broker's failure to verify proof of key possession for holder-of-key assertions. Exploitation requires intercepting a valid signed assertion. No patch or mitigation meeting Red Hat's criteria is currently available.