A vulnerability in Keycloak's protocol mapper and identity resolution components allows a client manager with limited permissions to impersonate a realm administrator by manipulating identity claims in sessionless service-account tokens. This occurs because these tokens lack session IDs, causing incorrect identity resolution. Exploitation grants full control over the affected realm.