REDHAT-BUG-2539280: Medium severity Red Hat Keycloak vulnerability
A flaw was found in the ConditionalOtpFormAuthenticator component of Keycloak. The vulnerability exists because the skip-header policy evaluates configured header patterns against raw request headers without verifying whether the request originates from a trusted proxy via the isProxyTrusted check. Exploitation requires that the target realm has a Conditional OTP flow configured with a skip rule for a specific HTTP header and that the attacker has already obtained a victim's password. By injecting the matching header directly into the login request, an attacker can cause Keycloak to treat the request as if it came from a trusted environment where OTP is not required. Successful exploitation allows an attacker to bypass multi-factor authentication, gain full access to the victim's account, modify user data, and perform administrative actions if the victim has elevated privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Exposure requires a realm with a Conditional OTP flow that includes a skip rule for a specific HTTP header. The issue is relevant when that header can be supplied directly in a login request.
What must an attacker have to exploit the issue?
The attacker must already know or obtain the victim's password and must inject a header matching the configured skip rule. They can then cause OTP to be skipped and authenticate as the victim.
What is the impact after a successful bypass?
A successful attacker can gain full access to the victim's account and modify user data. If the victim has elevated privileges, the attacker may also perform administrative actions.