Three Attacks on Passkeys: The Cryptography Held, but the Protection Was Bypassed

Passkeys were conceived as a replacement for passwords: they can't be reused and they resist phishing. Last week three independent research groups showed that the protection can be bypassed without breaking the underlying cryptography. None of the attacks “broke the math” — all of them exploit implementation flaws surrounding the keys.

The Signature Windows Kept

At Black Hat USA 2026, SpecterOps presented research called Pass-the-Passkey. According to the company, Windows stored past YubiKey signatures in the clear in a location readable by authenticated, non-privileged users, including remote ones. Combined with weaknesses in how Microsoft Entra ID verifies passkeys, this made it possible to impersonate a privileged user while formally satisfying the requirements of phishing-resistant MFA. There's no need to extract the private key from the authenticator — an already-generated signature is enough. The Windows vulnerability (an information disclosure in the event logging service) was assigned CVE-2026-34348 with a score of 6.5; Microsoft released an update and said it had applied mitigations on the Entra side.

The Master Key for Google's Synced Passkeys

In its work titled Pass-ta-key, Unit 42 targeted Google Password Manager in Chrome on Windows. All of the attacks begin with malware already running on the device — without elevation to administrator. The most dangerous variant, Golden Pass-ta-key, obtains the Security Domain Secret — a 32-byte master key that protects synced passkeys. The secret was initially found in Chrome's logs; Google removed it from there, but according to the researchers it is still temporarily present in the process's memory during re-enrollment. With this key, an attacker can recover the victim's private keys. Worse still, the current implementation offers no rotation or revocation of this secret, which makes a compromise long-lasting.

Windows Hello Without a Fresh PIN

Independent researcher Dirk-jan Mollema showed that a low-privileged process in an already-compromised session can use a hardware-bound Windows Hello for Business key without prompting the user for a PIN or biometrics. The key is used as a FIDO2 credential against Entra ID. Meanwhile, Entra's WebAuthn request is valid for five minutes and is not tied to a session, user, or tenant: a challenge requested on the attacker's machine can be signed on the victim's device and returned as a valid assertion.

Strong Cryptography, Weak Surroundings

The common lesson: choosing between synced and device-bound passkeys doesn't close the gap — the flaws hide in the surrounding mechanisms for trust, recovery, and storage. The attacks by Unit 42 and Mollema start only after the endpoint has been compromised, not from an anonymous remote position. Defenders are advised to install the update for CVE-2026-34348, to actually verify the user-verification flag, and to treat passkey stores and browser memory as sensitive data. The stakes are rising: starting September 1, 2026, Entra ID users on SMS and voice authentication will begin to be automatically enrolled in passkeys, and code delivery by SMS and voice is slated to be retired on February 1, 2027.

Source: The Hacker News