A New Era of Threats Emerge as Passkey Authentication Falls Short
In a shocking revelation, researchers have uncovered 39 new methods that compromise passkey authentication, a supposedly secure alternative to traditional passwords. These techniques, some already implemented in proof-of-concept tools or demonstrated in real-world attack patterns, expose a fundamental flaw in the passkey system: its reliance on trust boundaries that can be easily exploited.
Passkeys were touted as a revolutionary solution to the age-old password problem. By leveraging public key cryptography and binding credentials to legitimate services, they promised to make phishing and credential theft attacks significantly harder. However, this security conversation has evolved rapidly, and the vulnerabilities have been exposed.
The attack surface is vast, involving multiple trust boundaries that can be targeted by attackers. A modern passkey authentication ceremony involves numerous layers, including web applications, browsers, operating systems, password managers, cloud synchronization services, mobile devices, Bluetooth transport, account recovery systems, enrollment processes, help desks, and ultimately, the human user approving the authentication.
Researchers have published techniques to exploit almost every one of these layers. For instance, assertion mining, where attackers extract assertions from legitimate sessions, can be used to bypass passkey-based authentication. Similarly, circuit breaker attacks, where malicious actors manipulate the authentication flow by injecting fake challenges or responses, can compromise even the most secure passkey implementations.
One striking example of this problem was demonstrated by SpecterOps in their Pass the Passkey research. They showed that malware does not necessarily need to extract a private key to compromise passkey-based authentication. By asking the legitimate WebAuthn infrastructure to generate a signed assertion, a malicious application can trick users into approving an attacker-controlled session.
The distinction here is crucial: cryptography is not where passkeys fail; it’s in the trust boundaries that are exploited by attackers. Unless passkeys are tied to dedicated biometric hardware, they remain vulnerable to manipulation.
Moreover, even the passkey prompt itself has become an attack surface. Researchers have demonstrated techniques like passkey prompt flooding, credential interface deception, and FIDO interface overlay attacks, which can deceive users into approving malicious authentication sessions.
The lesson is clear: phishing resistance at the cryptographic protocol layer does not guarantee deception resistance across the operating system, browser, application, and user interface layers surrounding that protocol. As passkeys become more prevalent, their vulnerability to manipulation will only grow.
One practical takeaway from this research is the need for organizations to reassess their security posture in light of these new threats. By acknowledging the limitations of passkey-based authentication and implementing additional security measures, such as dedicated biometric hardware or multi-factor authentication, enterprises can strengthen their identity assurance and protect against emerging threats.
Source: Bleeping Computer — 2026-09-04