A vulnerability in the Admin REST API of Keycloak allows delegated administrators without reset-password permissions to delete user password credentials. This flaw prevents affected users from logging in by removing their password credentials. The issue is due to improper permission checks on the endpoint responsible for deleting user credentials.