Scenario 11: Two custom AuthenticationProvider beans both support UsernamePasswordAuthenticationToken, and users are being authenticated against the WRONG identity store.

ProviderManager tries providers in the order they are registered and generally uses the first one that successfully authenticates (or throws a hard failure) — if the higher-priority provider happens to also accept credentials meant for a different store (e.g., a test/legacy provider left registered), it can silently 'win' over the intended provider. Fix by explicitly controlling provider order (e.g., building the ProviderManager's provider list explicitly) and removing/disabling providers not meant for the current environment.