A vulnerability in the JWT Authorization Grant implementation of the keycloak-services component allows an authenticated client to bypass identity provider login restrictions during the JWT-based grant flow. This flaw occurs because claim filtering and other login restrictions configured for OIDC or Google identity providers are enforced during standard browser logins but skipped in the JWT grant flow. As a result, an attacker with valid client credentials and a signed assertion can obtain access tokens for users who should have been blocked by these restrictions.