A vulnerability in Keycloak's Standard Token Exchange V2 allows authenticated requesters to indefinitely extend access for service accounts by repeatedly exchanging tokens. The system issues new tokens with a fresh lifetime based on the requester client's configuration rather than limiting it to the original token's expiration. This flaw enables persistent access even if the original client is disabled by an administrator.