{"id":"CVE-2026-96445","published":"2026-09-23T12:17:08.773","lastModified":"2026-09-24T14:51:56.593","description":"A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request.","cvssScore":6.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96445","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539280","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}