CVE-2026-96445: Keycloak OTP Auth Bypass Vulnerability

CVE-2026-96445 Overview

A flaw in the Conditional OTP authenticator of Keycloak allows attackers to bypass second-factor authentication. The authenticator evaluates specific HTTP headers to decide whether to skip the one-time password (OTP) prompt. It does not verify whether those headers originated from a trusted source. An attacker who already knows a user's password can submit a crafted header and skip the OTP check entirely. This weakness is tracked under CWE-287: Improper Authentication and affects Keycloak, an open source identity and access management (IAM) solution maintained by Red Hat.

Critical Impact

Attackers with valid credentials can bypass multi-factor authentication (MFA) by injecting a crafted HTTP header, defeating the primary control that protects compromised passwords.

Affected Products

• Keycloak (Conditional OTP authenticator component)
• Red Hat Build of Keycloak
• Red Hat Single Sign-On (downstream distributions)

Discovery Timeline

• 2026-09-23 - CVE-2026-96445 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96445

Vulnerability Analysis

Keycloak's Conditional OTP authenticator lets administrators bypass OTP prompts under defined conditions, such as trusted networks or corporate proxies. One available condition inspects HTTP request headers to decide whether the second factor is required. The authenticator trusts the header values as presented by the incoming request. It does not confirm the header was set by a trusted reverse proxy or gateway rather than the client itself. As a result, any remote user can supply the header directly. Keycloak then evaluates the condition as true and skips OTP. The flaw sits in the authentication decision logic, not in cryptographic verification. It converts MFA from a required control into an optional one for anyone who can craft an HTTP request.

Root Cause

The root cause is missing origin validation on request headers used as authentication decision inputs. Headers are attacker-controlled unless a trusted upstream component strips or overwrites them. The Conditional OTP flow reads the value without validating the transport path or a signed marker from the proxy. This is a classic trust boundary error mapped to CWE-287.

Attack Vector

Exploitation requires the attacker to already possess a valid username and password, either through phishing, credential stuffing, or reuse from a prior breach. The attacker then sends an authentication request to the Keycloak login endpoint with the specific header configured in the Conditional OTP flow. The authenticator matches the header value, skips the OTP challenge, and issues a session. No user interaction is required, and no interaction with the legitimate MFA device is needed. Attack complexity is elevated because the attacker must know which header the deployment evaluates and the expected value, per the Red Hat CVE-2026-96445 Advisory.

Detection Methods for CVE-2026-96445

Indicators of Compromise

• Successful authentications where the Keycloak event log shows no OTP_VERIFY or equivalent second-factor event for accounts that normally require OTP.
• Login events originating from IP ranges outside the trusted proxy CIDR, yet matching the Conditional OTP skip condition.
• Unexpected HTTP headers such as custom X- values appearing on requests that reach Keycloak from untrusted network segments.

Detection Strategies

• Enable Keycloak event logging and forward LOGIN and LOGIN_ERROR events to a SIEM for correlation with expected OTP events per user.
• Alert on authentication sessions that complete without a second-factor step for user accounts enrolled in OTP.
• Inspect reverse proxy logs for client-supplied headers that duplicate or override headers normally added by the proxy.

Monitoring Recommendations

• Baseline the number of OTP challenges per user per day and alert on sudden drops that indicate skipped prompts.
• Monitor Keycloak admin events for changes to the Conditional OTP authenticator flow or its header-based conditions.
• Correlate successful logins with geolocation and device posture to surface sessions that skipped MFA from unfamiliar contexts.

How to Mitigate CVE-2026-96445

Immediate Actions Required

• Review every authentication flow that uses the Conditional OTP authenticator and identify configurations that skip OTP based on HTTP headers.
• Replace header-based skip conditions with network-based conditions tied to authenticated proxy IP ranges until a patched Keycloak build is deployed.
• Force re-authentication and rotate active sessions for privileged accounts to invalidate any tokens obtained through the bypass.

Patch Information

Refer to the Red Hat CVE-2026-96445 Advisory and Red Hat Bugzilla Report #2539280 for fixed versions of Keycloak and Red Hat Build of Keycloak. Apply the vendor-supplied update as soon as it is available in your channel.

Workarounds

• Configure the upstream reverse proxy or ingress controller to strip client-supplied instances of the header used by the Conditional OTP condition before requests reach Keycloak.
• Require OTP unconditionally for administrative realms and service accounts by removing the Conditional OTP step from those flows.
• Restrict access to the Keycloak authentication endpoints so that only requests transiting the trusted proxy can reach them, using network policy or a web application firewall (WAF).

# Example NGINX snippet to strip an attacker-supplied header
# before proxying to Keycloak. Replace X-Skip-OTP with the
# header configured in your Conditional OTP flow.
location /realms/ {
    proxy_set_header X-Skip-OTP "";
    proxy_pass https://keycloak.internal;
}