Loading vulnerability…
Windows Event Logging Service WebAuthn Assertion Disclosure
CVE-2026-34348 is a protection-mechanism failure in the Windows Event Logging Service. Affected systems recorded complete WebAuthn/passkey assertion material, including authenticator data and cryptographic signature data, in Windows Event Logs. This exposure permitted authorized users able to access the relevant logs to obtain authentication material. Microsoft addressed the issue in its July 14, 2026 security updates by truncating logged signature fields to six bytes while retaining diagnostic utility.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authorized attacker can disclose sensitive WebAuthn assertion data over a network. In environments where a relying party fails to enforce WebAuthn anti-replay controls, exposed assertion material may be replayed to impersonate an authenticated user, including privileged cloud identities, and satisfy phishing-resistant MFA policies. Replay depends on additional server-side validation failures and is not an inherent consequence of the Windows information-disclosure flaw alone.
If you can’t patch tonight, do this now.
Until updates are fully deployed, restrict access to Windows Event Logs, especially remote and delegated log-reading permissions; limit execution on systems used for privileged passkey authentication; and use privileged-access workstations for administrative identities. Monitor for unusual event-log access and unapproved processes invoking WebAuthn APIs. Require hardware-backed passkey attestation for high-privilege accounts where supported.
Patch, then assume compromise.
Install Microsoft's July 14, 2026 or later security updates for all affected Windows client and server systems. Verify that deployed updates cause WebAuthn assertion signature fields in relevant event logging to be truncated. Relying parties should also enforce unique, session-bound challenges and validate authenticator signature-counter behavior to prevent replay of assertions exposed before patching.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.