A vulnerability in Keycloak's Pushed Authorization Request (PAR) implementation allows reuse of a pushed request URI when the silent authentication path with prompt=none is used. This bypass causes the security rule enforcing single-use of the request URI to be skipped, potentially enabling an attacker to obtain multiple authorization codes for a logged-in user, violating security standards such as FAPI-2.