A vulnerability in the SAML brokering component of Keycloak allows users to bypass ProxyRestriction constraints set by upstream identity providers. This flaw enables unauthorized login to downstream services despite explicit restrictions on session sharing. Exploitation requires a specific SAML brokering configuration and the presence of ProxyRestriction conditions from a trusted upstream provider. The issue stems from Keycloak's failure to enforce these ProxyRestriction constraints during the brokering process.