A vulnerability in Keycloak's TokenManager component allows an attacker holding an old stateless access token to gain access to a newly created service account if it shares the same client ID as a previously deleted one. This occurs because Keycloak falls back to using the username for user identification without verifying the token's original subject when the original user ID no longer exists. Exploitation requires administrative actions to delete and recreate clients with the same ID while an attacker retains a valid token.