A vulnerability in the Keycloak Account REST API allows a malicious client owner with client registration privileges to manipulate their security tokens to reference another user's active session. This flaw enables unauthorized access and modification of the victim's account information, potentially leading to full account takeover by changing recovery email and resetting the password. Exploitation requires specific session timing and user interaction. No effective mitigation is currently available that meets Red Hat's criteria for ease of use and applicability.