CVE-2026-96445

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Conditional OTP authenticator of Keycloak. The system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped but fails to verify if these headers originate from a trusted source. An attacker possessing a user's password can bypass second-factor authentication by including a specially crafted header in the request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.