A vulnerability in the OpenID Connect (OIDC) protocol implementation of Keycloak allows an application holding a valid refresh token to obtain new access tokens for a client that has been disabled. This occurs because Keycloak does not verify whether the target audience client is still enabled during the token refresh process. This flaw can potentially bypass administrative access controls for resource servers relying on offline JWT validation.