A flaw was found in the org.keycloak.services package of Keycloak. When an authentication flow is initiated through the login-actions/reset-credentials entry point, the resulting authorization session fails to evaluate and apply client-level mandatory PKCE settings. If a user subsequently navigates back to the standard login form and completes authentication, Keycloak issues an authorization code that lacks associated code challenge metadata. Because the token endpoint validates PKCE based on the presence of metadata in the code rather than the client configuration, the code can be redeemed for tokens without a code_verifier. An attacker who intercepts this authorization code can perform a code injection attack to obtain access and refresh tokens, allowing them to impersonate the victim and access or modify protected data.