EUVD-2026-85223
GHSA-jj9w-64w4-2wcx
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable but AC:H due to required non-default header-skip config; PR:L reflects needing the victim's password; full account takeover gives C:H/I:H, no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request.
AnalysisAI
Second-factor authentication bypass in Keycloak's Conditional OTP authenticator allows an attacker who already possesses a user's password to skip OTP verification by sending a crafted HTTP header, provided the realm is configured to evaluate headers for OTP-skipping without validating their source. This flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, has a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and requires a non-default configuration plus a compromised first factor, meaning it is an account-targeted MFA bypass rather than unauthenticated remote compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete conditions: (1) the Keycloak realm's Conditional OTP authenticator flow must be configured to determine OTP-skipping from HTTP headers (a non-default, proxy/gateway-oriented setup) without the deployment enforcing that those headers come only from a trusted front-end; and (2) the attacker must already possess the target user's valid password (first factor compromised via phishing, reuse, or credential stuffing). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine second-factor authentication bypass in Keycloak's Conditional OTP authenticator, and MFA-bypass flaws in a widely-deployed IAM platform warrant priority attention despite the moderate 6.8 base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified in the provided intelligence; consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-96445) for patch availability and fixed versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote at
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulne
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severit
Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), thi
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remote
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack c
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today