A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because sometimes reuses identifiers doesn’t clean up properly during logout when browser cookies are missing. As result, one may receive tokens that belong user.