The issue is in OidcClientImpl.java, where `add()` is used instead of `set()` for JWT bearer authentication parameters. Other authentication methods correctly use `set()`.

This causes a mismatch between the expected behavior (replacing previous values) and the actual behavior (accumulating values).

Replaced the `add()` method calls with `set()` in the JWT bearer authentication code path:

```java
// Replace these lines:
body.add(OidcConstants.CLIENT_ASSERTION, clientAssertion);
body.add(OidcConstants.CLIENT_ASSERTION_TYPE, OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE);

// With:
body.set(OidcConstants.CLIENT_ASSERTION, clientAssertion);
body.set(OidcConstants.CLIENT_ASSERTION_TYPE, OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE);
```

This would ensure only the newest key-value pairs are included in the request, eliminating the duplication problem.

• Fixes: #48879