As Microsoft gears up to make passkeys the default authentication method for its cloud-based identity and access management service, a closer look at their implementation has revealed some unsettling vulnerabilities. Researchers from SpecterOps have found three nearly exploitable zero-day flaws in Windows 11 and Microsoft Entra ID that could allow attackers to impersonate privileged users, even with phishing-resistant multifactor authentication (MFA) in place.
These vulnerabilities are particularly concerning because they mirror old password-related attacks, such as pass-the-hash and NTLM relay. According to Michael Grafnetter, principal security researcher at SpecterOps, the flaws are a stark reminder that passkeys are not foolproof and can be vulnerable if their implementation is flawed. “Passkeys are still a major improvement over passwords,” he notes, “but they are not magic.” By exploiting these vulnerabilities, attackers could bypass WebAuthn cryptography, which is the underlying technology driving passkeys.
The flaws were discovered in Windows 11’s handling of digital keys and assertions, which are used to verify user identities when logging into secure systems. Specifically, the researchers found that Windows 11 was writing a complete copy of the digital key to the event log, and Entra ID failed to properly prevent those assertions from being reused. This allows an attacker to exploit these flaws and impersonate privileged cloud users, bypassing even the most robust MFA requirements.
The risk here is not with the WebAuthn standard itself but with incomplete or incorrect implementations. As Grafnetter warns, organizations using Windows Hello or FIDO2 security keys, such as Yubikeys with Entra ID, should pay particular attention to these flaws. Developers should rely on well-tested WebAuthn frameworks rather than build their own, since passkey validation involves nontrivial cryptography and several important checks.
One of the most disturbing aspects of this research is that even Microsoft, a co-author of the WebAuthn standard, missed some of the assertion validation steps required by the specification. The findings were disclosed to Microsoft, which quietly deployed a mitigation in their cloud services before Grafnetter discovered it while recording demonstrations for his Black Hat presentation.
The main Windows passkey vulnerability was assigned CVE-2026-34348 and patched on July 14, just days before the Black Hat conference. While this patch is a step in the right direction, it highlights the need for continued vigilance and attention to detail when implementing new security measures.
In conclusion, while passkeys are an improvement over passwords, they are not invincible. As we move towards a passwordless future, it’s essential to remember that their implementation matters just as much as their underlying technology. By understanding these vulnerabilities and taking steps to address them, organizations can ensure that the shift to passkeys is secure and successful.
Source: Dark Reading — 2026-07-22