A vulnerability in the OIDC token introspection endpoint of the keycloak-services component allows a confidential client to receive full token claims for tokens issued to different audiences. Although the token is marked inactive for the unauthorized client, the endpoint still returns sensitive token claims within a signed JWT. This flaw enables unauthorized clients to bypass audience-based restrictions and access sensitive information.