A vulnerability in the Conditional OTP authenticator of Keycloak allows bypassing second-factor authentication. The flaw arises because the system does not verify whether certain HTTP headers used to decide OTP skipping originate from trusted sources. An attacker with a user's password could exploit this by crafting headers to bypass the OTP requirement.