New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing
Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.
SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.
- CVE-2026-34348: Windows Event Logging Service info disclosure (CVSS 6.5), patched in July 2026 updates
- Entra ID still uses JWTs as WebAuthn challenges and does not bind them to session cookies
- Unit 42 recovered Google Password Manager's 32-byte Security Domain Secret; eBay tightened user-verification checks
- Mollema: in-session malware can reuse hardware-bound Windows Hello for Business keys without re-authentication
- Findings presented at Black Hat USA 2026; no exploitation observed outside test environments
- CVEs
- CVE-2026-34348
- Organizations
- SpecterOpsUnit 42Black Hat
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-34348 | Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network | 6.5 | <1% |
From the original article
6 min read at thehackernews.com
Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.