A newly disclosed "Pass-the-Passkey" family of attacks showcases how implementation flaws in WebAuthn can compromise passkey protections, even when private keys remain within hardware security keys or trusted device enclaves. SpecterOps researchers discovered over 20 attack vectors impacting Windows 11, Microsoft Entra ID, web browsers, password managers, and enterprise authentication workflows. The techniques exploit the surrounding ecosystem of passkeys, including endpoint logging, server-side assertion validation, authentication prompts, and application interfaces.
Although an assertion isn't the private passkey itself, it remains sensitive authentication material that shouldn’t be reused outside its original login transaction. Typically, relying parties should prevent this by generating one-time challenges, binding each challenge to a specific login session, rejecting reused requests, and validating authenticator signature-counter behavior when available.
Patched systems truncate the signature component stored in the log to six bytes, preserving limited troubleshooting capability while preventing an event entry from being used as a full replayable assertion. Pass-the-Passkey Attacks Overview (Source: SpecterOps.io) Malware on compromised endpoints can invoke passkey APIs to present authentication requests, repeatedly trigger prompts for user fatigue, or manipulate calling-app details to make a request appear trustworthy. Security teams should also monitor access logs for WebAuthn events, investigate any unexpected calls from untrusted processes, limit privileged administration to hardened workstations, and detect, investigate, and respond quickly using in-browser data inspection tools like ANY.RUN.
