A race condition vulnerability exists in the HOTP authentication mechanism of the keycloak-services component, allowing reuse of a single one-time password (OTP) across multiple concurrent logins. This occurs because the system validates the OTP and updates its internal counter in separate steps without proper synchronization. Exploitation requires possession of valid user credentials and the ability to win a timing race during authentication. The vulnerability has been assessed as moderate severity with a CVSS score of 4.2.