A vulnerability in Keycloak's first broker login flow allows an attacker controlling an external identity to silently re-establish an account link due to leftover temporary proof not being cleared after linking or unlinking. This can lead to unauthorized access to the victim's account without further confirmation.