CVE-2026-96445: Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers
A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request.
Other sources
A flaw was found in the ConditionalOtpFormAuthenticator component of Keycloak. The vulnerability exists because the skip-header policy evaluates configured header patterns against raw request headers without verifying whether the request originates from a trusted proxy via the isProxyTrusted check. Exploitation requires that the target realm has a Conditional OTP flow configured with a skip rule for a specific HTTP header and that the attacker has already obtained a victim's password. By injecting the matching header directly into the login request, an attacker can cause Keycloak to treat the request as if it came from a trusted environment where OTP is not required. Successful exploitation allows an attacker to bypass multi-factor authentication, gain full access to the victim's account, modify user data, and perform administrative actions if the victim has elevated privileges.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
A realm is exposed only if it uses a Conditional OTP flow with a skip rule based on a specific HTTP header. The issue affects skip-header policy evaluation because configured header patterns are matched against raw request headers without confirming that they originated from a trusted proxy.
What does an attacker need to bypass OTP?
The attacker must already know or obtain the victim's password and must be able to send a login request containing a header that matches the realm's configured OTP skip rule. No user interaction is required.
Are deployments without header-based OTP skip rules affected?
The described exploitation requires a Conditional OTP flow configured to skip OTP for a specific HTTP header. The provided information does not indicate that OTP can be bypassed through this issue when such a skip rule is not configured.
How can administrators assess whether they are vulnerable?
Review each realm's authentication flows for the ConditionalOtpFormAuthenticator and identify Conditional OTP configurations that use header-based skip policies or matching header patterns. A matching header supplied directly in a login request is the relevant exposure condition when the source is not verified as a trusted proxy.