A race condition vulnerability was found in Keycloak within the HOTP HMAC-based One-Time Password validation logic in keycloak-services. When a realm is configured with an HOTP policy, the operations to validate a submitted code and increment the HOTP counter are performed non-atomically and without concurrency locking. An attacker who has already obtained a valid users credentials and a single valid HOTP code can send multiple concurrent authentication requests to the OpenID Connect token endpoint. Because of the lack of synchronization, multiple requests may be validated against the same counter value before it is successfully incremented. This allows an attacker to bypass the one-time use restriction of the HOTP code and establish multiple concurrent authenticated sessions.