A flaw was found in Keycloaks Pushed Authorization Request PAR implementation. The fix for CVE-2026-96446 moved PAR consumption to authentication completion by checking for the AUTHORIZATION_REQUEST_URI authentication session note. However, triggering an authentication flow restart via /login-actions/restart clears authentication session notes while preserving client notes including request parameters such as redirect_uri, scope, state, and nonce. Consequently, when authentication completes after a flow restart, the PAR consumption check is skipped, leaving the request_uri active in the single-use store.
An attacker can replay the same request_uri within its valid lifespan default 60 seconds to obtain a second authorization grant and distinct access token. This bypasses the single-use guarantee required by RFC 9126. Successful exploitation allows an attacker to mint multiple authorization codes and access tokens from a single pushed request.