The vulnerability in Red Hat Build of Keycloak's Conditional OTP authenticator stems from the system evaluating certain HTTP headers to decide whether to skip one-time password (OTP) authentication without verifying the trustworthiness of those headers. An attacker with knowledge of a user's password can craft a request with manipulated headers to bypass the second-factor authentication, gaining unauthorized access. The issue is specific to realms using a non-default Conditional OTP configuration. Red Hat rates this vulnerability as moderate severity with a CVSS 3.1 score of 6.8 (Network attack vector, High attack complexity, Low privileges required, No user interaction, Unchanged scope, High confidentiality and integrity impact, No availability impact).

Successful exploitation allows an attacker who already has a user's password to bypass the second-factor OTP authentication, potentially gaining unauthorized access to the user's account. The vulnerability impacts confidentiality and integrity but does not affect availability. Exploitation requires a specific Conditional OTP configuration and knowledge of the user's password.

Red Hat currently does not provide an official patch or mitigation that meets its criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates. Since exploitation requires a non-default Conditional OTP configuration and prior knowledge of the user's password, organizations should consider additional protective measures such as restricting access to trusted networks or proxies that set these headers. Review and harden Conditional OTP configurations to avoid reliance on untrusted headers. Engage Red Hat support or Technical Account Managers for tailored guidance.