A flaw was found in the ConditionalOtpFormAuthenticator component of Keycloak. The vulnerability exists because the skip-header policy evaluates configured header patterns against raw request headers without verifying whether the request originates from a trusted proxy via the isProxyTrusted check.
Exploitation requires that the target realm has a Conditional OTP flow configured with a skip rule for a specific HTTP header and that the attacker has already obtained a victim's password. By injecting the matching header directly into the login request, an attacker can cause Keycloak to treat the request as if it came from a trusted environment where OTP is not required. Successful exploitation allows an attacker to bypass multi-factor authentication, gain full access to the victim's account, modify user data, and perform administrative actions if the victim has elevated privileges.