Flaws in Passkey Implementation Show Old Attacks Still Work
Researchers at SpecterOps discovered several exploitable flaws in Microsoft's passkey implementation, particularly within Microsoft Entra ID, that could allow attackers to impersonate privileged users and bypass MFA. Despite passkeys being touted as phishing-resistant, these vulnerabilities highlight that the technology is not a silver bullet and requires robust server-side validation and endpoint security to mitigate risk. The vulnerabilities were patched, but the research underscores the importance of a layered security approach.
Microsoft has announced that starting September 1st, passkeys will become the default authentication method for Microsoft Entra ID, its cloud-based identity and access management service. However, researchers at SpecterOps have uncovered several vulnerabilities in this implementation. The primary risk isn't the passkey technology itself, but rather flawed implementations.
Specifically, SpecterOps found that Windows 11 was writing a complete copy of the digital key to the event log, and Entra ID failed to prevent these assertions from being reused. This allowed an attacker to impersonate privileged cloud users and bypass phishing-resistant multi-factor authentication (MFA) requirements. The research team calls this chain of events "Pass-the-Passkey," mirroring older Windows hacking techniques like pass-the-hash and NTLM Relay.
These vulnerabilities stem from a protection mechanism failure in Windows Event Logging Service, assigned CVE-2026-34348. Microsoft deployed a mitigation silently in their cloud services shortly after the research was disclosed. The researchers emphasized that passkeys shift the attackers’ focus rather than eliminate it, and that organizations should prioritize device-bound passkeys, enforce attestation, and avoid relying solely on MFA as a security layer.
Organizations using Windows Hello or FIDO2 security keys such as Yubikeys with Entra ID should pay particular attention to these flaws. Patching Windows 11 and restricting code execution are also recommended to address these vulnerabilities. Despite these issues, SpecterOps remains optimistic about the security of passkeys, noting that the attack paths are more complex than traditional password attacks.