A vulnerability was found in Keycloak where the JWT Authorization Grant (RFC 7523) fails to enforce login restrictions configured on OIDC or Google identity providers. Specifically, restrictions such as Filtered by claims or Hosted Domain are bypassed when the grant is processed. An authenticated confidential client with the JWT Authorization Grant enabled can submit a signed assertion for an existing federated user and receive realm tokens, even if the assertion contains claims that violate the identity provider's security policies. An attacker with client credentials and a validly signed assertion can bypass intended access controls to obtain unauthorized realm access for federated users.