{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","product":"Red Hat build of Keycloak 26.6.8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.6.8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","product":"Red Hat Single Sign-On 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-96445","cwes":["CWE-287"],"description":"A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request.","epss":{"date":"2026-11-05","percentile":0.33448,"score":0.00391},"exploits":[],"kev":null,"metrics":[{"score":6.8,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":6.8,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793963842490,"publishedAt":1790161966785,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:95761"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-96445"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539280"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:95761"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-96445"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539280"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"bfb4c8ff026fef45e888662a9a19a680143898d42d6210c7f9bc3249a8fb6248","sources":[{"modifiedAt":1793960833448,"name":"CNA: redhat","retrievedAt":1793963482414,"url":"https://www.cve.org/CVERecord?id=CVE-2026-96445"},{"modifiedAt":1793963842490,"name":"NVD","retrievedAt":1793967459973,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96445"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793963498621,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96445"}],"ssvc":{"assessedAt":1790187539386,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers","updatedAt":1793967459973}