Token binding bypass via unchecked client certificate

Authentication bypass in Red Hat build of Keycloak allows remote authenticated users to obtain unrestricted tokens through Standard Token Exchange V2. The exchange path fails to verify that the client presents the certificate bound to an mTLS holder-of-key subject token and issues a bearer token instead. Exploitation requires stolen client credentials, an mTLS-bound token, and a deployment using Standard Token Exchange V2; the resulting token lacks the original proof-of-possession restriction.