A CSRF flaw was found in Keycloak. This issue occurs due to the lack of a unique token sent during the authentication POST request, /login-actions/authenticate. An attacker could craft a malicious login page and trick a legitimate user of an application into authenticating with an attacker controlled account instead of their own.