A vulnerability in the SAML adapter component of Keycloak allows an attacker controlling one of multiple identity providers sharing the same signing key to bypass authentication. The flaw arises because the adapter does not verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the application. Exploitation can lead to unauthorized access, including full administrative control of applications protected by the Keycloak SAML adapter.