Pass-the-Passkey Attacks Expose Windows 11 and Microsoft Entra ID, Bypassing MFA
Brief
A new “Pass-the-Passkey” family of attack techniques demonstrates how systemic implementation flaws surrounding WebAuthn can undermine passkey security even when cryptographic private keys remain securely stored inside hardware tokens or trusted enclaves.
SpecterOps research highlights three core vulnerabilities across the WebAuthn ecosystem and over 20 distinct attack techniques impacting Windows 11, Microsoft Entra ID, web browsers, password managers, and enterprise authentication workflows.
Pass-the-Passkey Bypass Phishing-Resistant MFA
WebAuthn Authentication Flow (Image Source: Specterops.io)
The primary attack chain identified by SpecterOps stems from Windows 11 logging complete, un-truncated WebAuthn assertion responses generated during passkey authentication events.