New Passkey Attacks Reveal Critical Security Flaws
Research demonstrates how passkey protections can be bypassed without breaking cryptography.
1Discovery of Passkey Vulnerabilities
Three separate research teams revealed methods to bypass passkey protections without breaking the underlying cryptography. Passkeys were designed to replace reusable passwords and resist phishing. However, attackers found ways to reuse signed authentication materials exposed by Windows, abuse cloud-synced passkey systems, and use Windows Hello for Business keys without fresh PIN or biometric checks.
2Microsoft's Security Vulnerability and Fixes
Microsoft's CVE-2026-34348 vulnerability in Windows Event Logging Service received a CVSS score of 6.5, prompting a security update. Microsoft stated it applied mitigations for the passkey relay issue reported by SpecterOps. However, technical details about the scope of Entra-side mitigations were not provided. Microsoft recommends adopting least-privilege access and phishing-resistant authentication methods.
3SpecterOps' Pass-the-Passkey Research
SpecterOps presented its Pass-the-Passkey research at Black Hat USA 2026. The study showed Windows stored past YubiKey signatures in cleartext, which could be combined with weaknesses in Microsoft Entra ID's passkey validation to impersonate privileged users. While this is a narrower flaw than breaking FIDO2, it still allows attackers to authenticate as someone else.
4Unit 42's Synced Passkey Attack
Unit 42 published its Pass-ta-key research targeting Google Password Manager's synced passkey system. The attack begins with malware already running on the victim's device. The most damaging variant, Golden Pass-ta-key, targets the 32-byte Security Domain Secret key, which can be temporarily present in Chrome's process memory during re-registration, allowing attackers to recover victims' passkey private keys.
5Mollema's Windows Hello for Business Findings
Mollema demonstrated that a Windows Hello for Business key, though protected by the Trusted Platform Module, could be used in a compromised user session without a fresh PIN or biometric check. This key could then be used as a FIDO2 credential against Microsoft Entra ID. The WebAuthn challenge remains valid for five minutes and isn't bound to a session, user, or tenant.
6Entra ID Validation Issues
Findings by SpecterOps and Mollema exposed weaknesses in Entra ID's validation processes. It remains unclear whether these behaviors stem from the same underlying issue or different checks producing similar outcomes. Microsoft is expected to provide comprehensive solutions to address these vulnerabilities.
7Risks and Recommendations for Users
These attacks jeopardize passkey security, enabling attackers to steal synced passkey private keys or misuse Windows Hello keys. Users are advised to adopt least-privilege principles, use phishing-resistant authentication, and maintain endpoint protections. Zero Trust security models are also recommended to mitigate risks.
8Future Security Measures
These studies highlight weaknesses in passkey systems, urging manufacturers to develop stronger validation mechanisms. Companies like Microsoft and Google must promptly address these flaws to restore trust in passkeys. Adopting Zero Trust security models will be crucial in enhancing overall security posture against such sophisticated attacks.
Original article: The Hacker News — Yeni Passkey Saldırıları ile Güvenlik Açıkları Ortaya Çıktı