A vulnerability in Keycloak's authentication session management allows users to bypass enforced stronger authentication flows, such as mandatory two-factor authentication (2FA). By manually visiting a specific session restart link during login, users can clear internal markers tracking required security steps and log in with only a password, circumventing the 2FA setup requirement.