A vulnerability in the SAML broker component of Keycloak allows replay of SAML assertions when using the IdP-Initiated flow. The flaw is due to failure to enforce the OneTimeUse condition, enabling attackers who capture a valid assertion to reuse it multiple times. This can lead to session hijacking and unauthorized access as the targeted user.