Recent findings from three independent research teams have cast a spotlight on the practical security of passkeys, revealing that while the underlying FIDO2 cryptography remains uncompromised, vulnerabilities in the surrounding "human infrastructure" can still lead to successful circumvention of these highly touted phishing-resistant authentication methods. This development challenges the prevailing belief among many security professionals and users that passkeys offer an impenetrable defense against common attack vectors like phishing, prompting a re-evaluation of how these credentials are implemented and managed within complex digital ecosystems. The research, surfacing concurrently from SpecterOps, Palo Alto Networks’ Unit 42, and independent researcher Dirk-jan Mollema, underscores a critical lesson: even the most robust cryptographic protocols can be undermined if the systems designed to support them harbor exploitable weaknesses.
The Promise of Passkeys and FIDO2 Security
For years, the cybersecurity community has championed passkeys, built on the FIDO2 standard, as the definitive answer to the pervasive threat of phishing. Traditional password-based authentication, often supplemented by less secure multi-factor authentication (MFA) like SMS codes, has proven highly susceptible to social engineering attacks. Phishing, which relies on tricking users into revealing their credentials, accounts for a significant percentage of data breaches annually. According to IBM’s Cost of a Data Breach Report 2023, phishing was the most common initial attack vector, responsible for 16% of breaches. The average cost of a phishing-related breach was estimated at $4.76 million, highlighting the urgent need for more resilient authentication.
Passkeys, designed to be phishing-resistant, leverage public-key cryptography. When a user creates a passkey for a service, a unique cryptographic key pair is generated: a public key stored with the service and a private key securely stored on the user’s device (e.g., smartphone, computer, security key). During login, the service sends a challenge to the user’s device, which uses the private key to sign the challenge. This signature is then verified by the service using the stored public key. Crucially, the private key never leaves the device, and the authentication process is cryptographically bound to the legitimate service, making it theoretically impossible for an attacker to phish the private key or replay a captured signature on a different, malicious site. FIDO2’s "verifier impersonation resistance" is designed precisely to prevent credentials from being released to anything other than the legitimate service that registered them. This inherent design was believed to render passkeys immune to the most common forms of credential theft.
Unpacking the Infrastructure Flaws: Three Parallel Investigations
Despite the cryptographic strength of FIDO2, the three independent research efforts demonstrated distinct pathways to compromise passkey-protected accounts without ever needing to "crack" the underlying mathematics. Instead, they exploited misconfigurations, insecure logging practices, memory handling issues, and validation weaknesses in the broader system architecture surrounding passkey implementation. These findings, presented around the same period, including at prominent security conferences like Black Hat USA, revealed a common thread: the security perimeter is often weakest where human-designed systems interact with core cryptographic processes.
1. SpecterOps: The "Pass-the-Passkey" Replay Attack (CVE-2026-34348)
The first significant discovery came from SpecterOps principal researcher Michael Grafnetter, who detailed the "Pass-the-Passkey" findings at Black Hat USA. This research focused on a critical vulnerability within Microsoft Windows, tracked as CVE-2026-34348, an information-disclosure flaw in the Windows Event Logging Service.
Grafnetter’s team uncovered that Windows, under certain configurations, had been storing past YubiKey signatures in cleartext. These signatures, generated during legitimate authentication events, were accessible from a location readable by authenticated but unprivileged users. In some enterprise setups, this access extended to remote users, significantly broadening the attack surface.
The attack chain involved exploiting these exposed signatures in conjunction with weaknesses in how Microsoft Entra ID (formerly Azure Active Directory) validated passkey assertions. An attacker, having gained access to a compromised Windows machine, could extract these previously generated signatures. Crucially, the attacker did not need to extract the private key from the YubiKey or any other authenticator. Instead, they "replayed" the legitimate signature against Entra ID. Because Entra ID accepted this replayed signature, it allowed for privileged-user impersonation, even for accounts explicitly protected by policies mandating phishing-resistant MFA.
This vulnerability, now addressed by Microsoft, spanned various Windows versions, including Windows 10, Windows 11, and Windows Server releases. The distinction here is vital: the FIDO2 cryptography itself remained robust. The failure stemmed from an infrastructural oversight – the logging service retained sensitive authentication material in an insecure manner, and the validation service accepted a replayed, session-independent assertion. Functionally, however, the outcome for the victim is identical to a direct compromise: an unauthorized entity signing in as them.
2. Palo Alto Networks Unit 42: "Pass-ta-key" and the Golden Passkey Vulnerability
The second thread of research, titled "Pass-ta-key" by Palo Alto Networks’ Unit 42, highlighted vulnerabilities within Google Password Manager’s synced-passkey system, specifically within Chrome on Windows. This research is particularly unsettling due to its focus on a feature widely used by everyday consumers, often without a deep understanding of its underlying security mechanisms.
Unit 42 demonstrated three attack variants, all of which presupposed the presence of malware already running on the victim’s machine. Notably, these attacks did not necessarily require full administrator-level access, meaning a less sophisticated malware infection could still be sufficient.
The most severe of these variants, dubbed "Golden Pass-ta-key," targeted the "Security Domain Secret." This 32-byte master key is responsible for protecting every one of a user’s synced passkeys within Google’s ecosystem. Researchers initially discovered this secret exposed in Chrome’s own device logging output. While Google has since removed it from that specific log, Unit 42 indicated that the secret could still be temporarily present in Chrome’s process memory during passkey re-registration events.
Once an attacker recovers this Security Domain Secret, they gain the ability to derive and recover the victim’s actual synced passkey private keys. This goes beyond a simple signature replay; it grants the attacker the "master key" to all synced passkeys. The persistence of this compromise is a significant concern: currently, there is no mechanism for users to rotate or revoke their Security Domain Secret. This means that a compromise of this secret could have long-lasting implications, persisting even after typical credential reset procedures, presenting a persistent threat to all associated synced accounts.
3. Dirk-jan Mollema: Abusing Windows Hello for Business Keys without Prompts
The third piece of the puzzle came from independent researcher Dirk-jan Mollema, whose "Windows Hello abuse research" centered on Windows Hello for Business. This system typically stores its backing key within a Trusted Platform Module (TPM), a hardware component designed to protect cryptographic keys from extraction. Mollema confirmed that the TPM’s security model held true – the key genuinely cannot be exported.
However, Mollema discovered that software already running within a victim’s compromised session does not need to export the key. Instead, it can simply call Windows’ own cryptographic interfaces and direct the TPM to use the key for signing operations. Crucially, this can be done without triggering a fresh PIN or biometric prompt that the user would typically expect and notice. This allows malware to silently leverage the user’s legitimate, hardware-backed passkey.
Mollema then used this silently accessed key as a valid FIDO2 credential against Microsoft Entra ID. In the course of this, he identified a further vulnerability: Entra ID’s WebAuthn challenge, issued for authentication, remained valid for a full five minutes and was not tightly bound to a specific session, user, or tenant. This meant an attacker could request a challenge on their own system, transfer it to the victim’s compromised machine, have the Windows Hello key sign it silently, and then return the signed challenge to Entra ID from the attacker’s system. The resulting sign-in would appear legitimate and could satisfy Conditional Access rules that specifically demand phishing-resistant authentication – precisely the protection organizations deploy passkeys to enforce.
Industry Response and Proactive Measures
Microsoft has responded proactively to these revelations. A company spokesperson confirmed that immediate mitigations have been applied for the reported issue involving passkey relay assertions, and a security update has been released to directly address CVE-2026-34348. This demonstrates a commitment to patching identified vulnerabilities swiftly.
Microsoft’s guidance to customers continues to emphasize a holistic security approach, recommending least-privilege access principles alongside phishing-resistant authentication and a broader Zero Trust security model. This effectively acknowledges that while passkeys are a strong component, no single credential type can, on its own, close every potential gap in a complex surrounding system. The Zero Trust model, which operates on the principle of "never trust, always verify," becomes even more critical, ensuring that access is continuously authenticated and authorized, regardless of whether the user is inside or outside the traditional network perimeter.
Regarding the Google Password Manager findings, Google has already taken steps to remove the Security Domain Secret from Chrome’s device logging output. However, the issue of its potential temporary presence in memory during re-registration and the lack of a user-initiated rotation/revocation mechanism for this master key remain points of concern that the company will likely need to address.
These discoveries come at a pivotal time, as Microsoft is aggressively pushing for broader passkey adoption. According to Microsoft’s SMS and voice retirement guidance, starting September 1, 2026, users currently enrolled in SMS or voice-based authentication for Entra ID will be automatically enabled for passkeys and encouraged to register them. Microsoft-provided SMS and voice delivery services are slated for full retirement by February 1, 2027. This impending transition makes understanding and mitigating these newly identified infrastructural gaps not just important, but genuinely urgent for organizations and individual users alike.
Broader Implications for Digital Security
The collective weight of these findings necessitates a nuanced understanding of passkey security, moving beyond a simplistic view of "unbreakable cryptography."
For Enterprises and Organizations:
- Urgency of Patching and Updates: Applying Microsoft’s security updates, particularly for CVE-2026-34348, is no longer optional but a critical requirement for any organization leveraging Windows and Entra ID.
- Enhanced WebAuthn Assertion Validation: Organizations that accept WebAuthn assertions must rigorously enforce user-verification requirements, rather than merely requesting them. Tightly binding authentication challenges to specific sessions and user contexts can prevent replay attacks and unauthorized use of silently signed credentials.
- Robust Endpoint Security: A significant takeaway is the increased importance of endpoint security. Two of the three attack paths require prior malware infection or a compromised session on the victim’s machine. This means investment in advanced endpoint detection and response (EDR), robust antivirus, and proactive threat hunting becomes even more crucial to prevent initial compromise that could then be leveraged against passkeys.
- Zero Trust Implementation: These incidents reinforce the fundamental principles of a Zero Trust security model. Assuming compromise at all layers, continuously verifying access, and implementing granular authorization policies are essential countermeasures to prevent initial endpoint compromises from escalating into full account takeovers, even with advanced authentication methods in place.
- Review of Passkey Deployment Strategies: As Microsoft phases out less secure MFA methods, organizations must ensure their passkey deployment strategies account for these newly identified infrastructural vulnerabilities, focusing on secure storage, rigorous validation, and comprehensive incident response plans.
For Individual Users:
- Passkeys Remain Superior, But Not Invincible: It is vital to reiterate that these findings do not mean passkeys are "broken" or that users should revert to passwords. Passkeys remain significantly more secure than passwords and even traditional SMS-based MFA, particularly against phishing attacks originating from anonymous internet positions. The core cryptography is still sound.
- Device Hygiene is Paramount: The research underscores that device security is intrinsically linked to passkey security. Users must practice good cyber hygiene, including running up-to-date antivirus software, being wary of suspicious links and downloads, and ensuring their operating systems and browsers are always patched. A compromised device can undermine even the strongest authentication.
- Awareness of Synced Passkey Risks: Users relying on synced passkeys in browser-based password managers should be aware of the potential for a "master key" compromise if their device is infected with sophisticated malware. While convenience is a benefit, it also introduces a centralized point of failure that requires robust protection.
- Layered Security Mindset: No single security solution is a silver bullet. Users should combine passkeys with strong device security, vigilance against social engineering, and an understanding that even advanced security requires continuous attention to the entire digital environment.
The Evolving Landscape of Authentication Security
These revelations mark another chapter in the continuous arms race between cybersecurity defenders and attackers. They highlight a crucial shift: as cryptographic protocols become increasingly robust, attackers naturally pivot to exploit weaknesses in the implementation, integration, and operational aspects of these systems. The "human infrastructure" – the logging services, memory buffers, session management, and validation logic – becomes the new battleground.
Ultimately, these findings serve as a powerful reminder that security is a continuous process of vigilance, adaptation, and defense-in-depth. Passkeys remain a foundational component of a secure, passwordless future. However, their true effectiveness hinges not just on their cryptographic elegance but on the meticulous design, rigorous implementation, and ongoing maintenance of the entire ecosystem in which they operate. For both developers and users, the lesson is clear: trust, but verify, and assume that every layer of the digital environment requires robust protection.
