A vulnerability in the Keycloak Admin REST API's user update mechanism allows delegated administrators without password reset permissions to change user credentials and take over accounts when Fine-Grained Admin Permissions are enabled. This flaw arises from missing authorization checks during general user profile updates.