Attackers can exploit flaws in Microsoft’s passkey systems in ways surprisingly similar to old password attacks, but that doesn’t mean it’s time to give up on passkeys.
There’s been a lot of attention on passkeys in recent years. They’re considered phishing-resistant, and their use of private keys means they are largely unaffected by data breaches when identity information and credentials are stolen. They also require zero memorization compared to traditional passwords because users embed authentication directly into the device by enabling biometrics or PINs. Even so, widespread adoption has been gradual.
That may change. Microsoft has announced that starting Sept. 1, passkeys will become the default authentication method for Microsoft Entra ID sign-in, the tech giant’s cloud-based identity and access management service.
With passkeys steadily becoming the norm, Michael Grafnetter, principal security researcher at SpecterOps, dug deeper into the security and risks of the passwordless alternative. That research, which will be presented next month at Black Hat USA conference in Las Vegas, uncovered three nearly exploitable zero-day vulnerabilities in Windows 11 and Microsoft Entra ID. Two of the vulnerabilities formed a replay chain that could eventually allow attackers to impersonate privileged cloud identities while bypassing phishing-resistant multifactor authentication (MFA).
Grafnetter calls the chain “Pass-the-Passkey” because it mirrors similar Windows hacking techniques, such as pass-the-hash and NTLM Relay, where attackers steal and reuse authentication credentials without needing the actual password.
“Passkeys are still a major improvement over passwords, but they are not magic,” Grafnetter tells Dark Reading. “Our research shows that if surrounding implementation is flawed, attackers can still reintroduce replay, relay, and phishing-like attack paths even when the underlying WebAuthn cryptography is sound.”
‘One Uncomfortable Lesson’
WebAuthn, developed as a joint initiative by the World Wide Web Consortium (W3C) and the FIDO (Fast Identity Online) Alliance, is the underlying technology that drives passkeys. It plays a crucial role by issuing specialized digital credentials that verify a user’s identity when logging into secure systems.
However, SpecterOps research found that Windows 11 was essentially writing a complete copy of the digital key to the event log. On top of that, Entra ID failed to properly prevent those assertions from being reused, adds Grafnetter, noting that organizations using Windows Hello or FIDO2 security keys, such as Yubikeys with Entra ID, should pay particular attention to these flaws.
An attacker could exploit these flaws to impersonate privileged cloud users and bypass phishing-resistant MFA requirements, he warns.
The main risk is not the standard itself but incomplete or incorrect implementations, Grafnetter says. Developers should rely on well-tested WebAuthn frameworks rather than build their own, since passkey validation involves nontrivial cryptography and several important checks, he adds.
“One uncomfortable lesson from our research is that even Microsoft, one of the co-authors of the standard, missed some of the WebAuthn assertion validation steps required by the specification,” Grafnetter notes.
The findings were disclosed to Microsoft, which “silently deployed a mitigation in their cloud services.” Grafnetter only discovered the fix while recording demonstrations for his Black Hat presentation.
The main Windows passkey vulnerability was assigned CVE-2026-34348, “a protection mechanism failure in Windows Event Logging Service that could allow an attacker to disclose information over a network.” It was patched on July 14, which Grafnetter notes was the last Patch Tuesday before the Black Hat conference.
Don’t Write Off Passkeys Yet
Not only did the research reveal holes in Microsoft’s passkey systems, but it also highlighted a broader industry lesson: Passkeys shift the attackers’ focus rather than eliminate it, Grafnetter says. They provide access, and that’s exactly what threat actors target.
For privileged users, in particular, he recommends that organizations prefer device-bound passkeys, enforce attestation, and avoid relying on phishing-resistant MFA as their only layer of protection.
Passkey cryptography may be strong, but endpoint security and server-side validation still matter a great deal, he stresses. Organizations should patch Windows 11, restrict code execution, use privileged-access workstations, and limit remote log access to address the flaws identified in these findings. Even so, he remains “optimistic about the security of passkeys.”
“The attack paths we describe remain much more complex than those in traditional password attacks, so we continue to recommend adopting passkeys,” he says.
