Recent research has unveiled multiple methods by which attackers can compromise passkey systems without breaking their underlying cryptographic protections. Passkeys, designed to replace traditional passwords and resist phishing attempts, are now under scrutiny due to these findings.
One significant discovery involves Windows and Microsoft Entra ID. Researchers demonstrated a method to impersonate privileged users by reusing signed authentication material exposed by Windows. This approach bypasses the need to steal the authenticator’s private key, effectively circumventing phishing-resistant multifactor authentication (MFA) protocols.
Another vulnerability was identified in Google Password Manager within Chrome. Attackers can exploit this system to recover private keys associated with a victim’s synced passkeys. This breach allows unauthorized access to accounts and sensitive information without direct interaction with the user.
Additionally, malware operating within an active Windows session can utilize a hardware-bound Windows Hello for Business key without prompting the user for reauthentication via PIN or biometric verification. This method enables attackers to maintain access to systems even after initial authentication, posing a significant security risk.
In response to these vulnerabilities, Microsoft has addressed the Windows logging issue, designated as CVE-2026-34348, with a security update. The company has also implemented mitigations for the passkey relay assertion issue and continues to enhance security measures across its authentication methods. Microsoft advises adopting a least-privilege access approach, utilizing phishing-resistant authentication methods, and maintaining robust endpoint protections through a Zero Trust security model.
These findings underscore the importance of continuous vigilance and adaptation in cybersecurity practices. Organizations should critically assess the security of passkey implementations, especially those involving cloud synchronization, and consider device-bound passkeys for higher assurance. Regular updates and adherence to best practices are essential to mitigate emerging threats in authentication systems.
