A vulnerability in the OpenID Connect (OIDC) Device Authorization Grant flow of Keycloak allows attackers who have stolen a user's password to bypass mandatory multi-factor authentication (MFA). This flaw occurs because the flow does not enforce the minimum authentication level configured by the client, enabling unauthorized access to the Keycloak Admin REST API.