This one is bad - unauthenticated user account take over.

If you're like me and only using it internally on a homelab, the risks are lessened, but if you expose keycloak to by the Internet - boy howdy