A flaw was found in Keycloak. A user holding only the impersonation realm-management client role can impersonate any enabled, non-service-account user in the realm, including full realm administrators. The impersonation endpoint restricts service accounts as targets but performs no privilege-level check on the target user. After impersonating an administrator, the attacker obtains a valid SSO session and can exchange it for a fully signed access token via a standard OIDC authorization-code flow, gaining complete administrative control over the realm (read/write all users, clients, roles, password resets). The impersonation role is designed as a lesser delegation for support staff, and this flaw defeats that separation.