Pass-the-Passkey Attacks Bypass Entra ID Phishing-Resistant MFA
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 9, 2026
SpecterOps disclosed a "Pass-the-Passkey" attack family that can undermine passkey-based authentication in Windows 11 and Microsoft Entra ID without extracting private keys from hardware tokens or trusted enclaves. The most serious chain used Windows 11 event logging that recorded full WebAuthn assertion responses and paired it with Entra ID replay-validation weaknesses, allowing attackers to replay harvested assertions and gain access to privileged cloud accounts while still meeting phishing-resistant MFA checks. Microsoft addressed the Windows logging exposure as CVE-2026-34348, truncating logged signature fields to six bytes.
The research also described local attack paths that abuse legitimate WebAuthn APIs for prompt flooding, application identity spoofing, remote desktop pass-through, and Credential UI spoofing, enabling local passkey phishing and user-fatigue scenarios. Researchers released open-source tooling to help defenders test for assertion injection, event-log mining, and WebAuthn API hooking, and recommended patching Windows 11, enforcing server-side anti-replay protections, monitoring WebAuthn API activity, and requiring hardware-backed attestation for high-privilege Entra ID accounts.
