Passkeys, the new authentication method designed to replace passwords and resist phishing, have been found to have vulnerabilities that could be exploited by attackers. Three separate research efforts have demonstrated ways to defeat passkey protections without breaking the underlying cryptography. These attacks reuse signed authentication material, abuse cloud-synced passkey systems, and exploit compromised user sessions to bypass phishing-resistant MFA.
The impact of these attacks varies. SpecterOps demonstrated a Windows and Microsoft Entra ID chain that could impersonate privileged users while satisfying phishing-resistant MFA, reusing signed authentication material rather than stealing the authenticator's private key. Unit 42 showed attacks against Google Password Manager in Chrome, including a path that recovers the private keys for a victim's synced passkeys. Independent researcher Dirk-jan Mollema showed that malware already running in a signed-in Windows session can use a hardware-bound Windows Hello for Business key without asking the user to unlock it again.
The fixes and mitigations differ. Microsoft's Windows logging vulnerability, CVE-2026-34348, has a vendor CVSS score of 6.5 and a Microsoft security update. Microsoft has also applied mitigations for the reported issue involving passkey relay assertions. However, the company's response did not provide technical details about the scope of the separate Entra-side mitigations.
The Unit 42 and Mollema findings also show why no single choice between synced and device-bound passkeys closes the broader attack surface. The attacks begin with malware already on the endpoint or inside an already compromised user session, demonstrating what passkeys may fail to contain after endpoint compromise.
To mitigate these vulnerabilities, immediate actions include installing Microsoft's applicable security updates for CVE-2026-34348, enforcing user-verification requirements for WebAuthn assertions, and treating passkey stores, recovery flows, and browser memory as credential-sensitive territory. Additionally, Entra defenders should monitor unusual Windows Hello for Business authentications without a device identifier and unexpected device registrations.
Microsoft is increasing the stakes for getting implementation details right. Starting September 1, 2026, Entra ID users currently enabled for SMS or voice authentication will be automatically enabled for passkeys and nudged to register them. Microsoft-provided SMS and voice delivery is scheduled to retire on February 1, 2027.
