A vulnerability in the Organization identity-first login flow of the Keycloak authentication server allows an attacker who is a member of multiple organizations to bypass authentication. The flaw occurs because a login success flag is not cleared properly when the user switches to registration or password reset paths, enabling the attacker to impersonate another user by providing their username. This results in full account takeover and access to connected applications.