Privilege escalation via unvalidated Keycloak access token

Authorization bypass in pac4j-oidc before 6.5.6 allows remote authenticated users to gain elevated roles via a forged access token. KeycloakRolesAuthorizationGenerator parses the realm_access and resource_access claims and adds their roles to the profile without checking the token's signature, issuer, audience, or expiry. A valid ID token and an application that relies on these generated roles are required; accepted forged roles can grant access reserved for higher-privileged users.