A Critical Flaw in Passkey Implementation Exposes Users to Old-Style Attacks
Researchers have uncovered a trio of vulnerabilities in Microsoft’s passkey systems that could allow attackers to impersonate privileged users, bypassing even the most robust forms of authentication. The findings, set to be presented at Black Hat USA next month, highlight the importance of proper implementation when it comes to these passwordless alternatives.
The flaws were discovered by Michael Grafnetter, a principal security researcher at SpecterOps, who notes that passkeys are not immune to exploitation simply because they don’t use passwords. “Our research shows that if the surrounding implementation is flawed, attackers can still reintroduce replay, relay, and phishing-like attack paths even when the underlying WebAuthn cryptography is sound,” he explains.
The vulnerabilities in question involve a combination of weaknesses in Windows 11’s event logging service and Entra ID, Microsoft’s cloud-based identity management platform. Specifically, researchers found that the system was writing a complete copy of the digital key to the event log, where it could be accessed by an attacker. Furthermore, Entra ID failed to properly prevent these assertions from being reused – allowing an attacker to potentially bypass even phishing-resistant multifactor authentication.
The “Pass-the-Passkey” attack, as Grafnetter dubs it, mirrors older Windows hacking techniques like pass-the-hash and NTLM relay. In these attacks, attackers steal and reuse authentication credentials without needing the actual password. By exploiting this vulnerability, an attacker could impersonate a privileged cloud user, gaining access to sensitive information and systems.
It’s worth noting that the main risk here is not in the standard itself, but rather in its incomplete or incorrect implementation. “Developers should rely on well-tested WebAuthn frameworks rather than build their own,” Grafnetter advises. “Passkey validation involves nontrivial cryptography and several important checks – it’s a complex process best left to experts.”
Microsoft has since patched one of the main vulnerabilities, assigning it CVE-2026-34348. The patch was deployed on July 14, just before the Black Hat conference. However, Grafnetter notes that the Entra ID vulnerability remains unpatched.
The findings serve as a reminder that even with advanced security measures in place, human error and poor implementation can still lead to devastating attacks. As passkeys become increasingly widespread, it’s essential for organizations to prioritize proper training and adherence to best practices when implementing these systems.
For individuals and businesses alike, the takeaway from this research is clear: while passkeys offer significant improvements over traditional passwords, they are not foolproof. By relying on well-tested frameworks and taking a thoughtful approach to implementation, we can minimize the risk of attack and ensure that our security measures remain effective in the face of evolving threats.
Source: Dark Reading — 2026-07-22