Recent findings reveal critical vulnerabilities in Windows 11 and Microsoft Entra ID, highlighting weaknesses in the Multi-Factor Authentication (MFA) process. The ‘Pass-the-Passkey’ attack techniques, identified by SpecterOps, exploit implementation flaws in WebAuthn, compromising security even when private keys are securely stored.
Uncovering WebAuthn Vulnerabilities
SpecterOps has identified three primary vulnerabilities within the WebAuthn ecosystem, affecting not only Windows 11 but also Microsoft Entra ID, web browsers, and enterprise authentication workflows. The research outlines over 20 distinct attack methods, emphasizing systemic weaknesses that could be exploited by attackers.
One significant flaw involves Windows 11 logging full WebAuthn assertion responses during passkey authentication. These logs, containing cryptographic signatures, can be accessed by attackers with local or delegated access, allowing them to replay assertions against endpoints lacking anti-replay validation.
Implications of Assertion Logging
The ability to harvest assertion material poses a serious threat, particularly when privileged cloud administrators use compromised systems. By exfiltrating this data, attackers can impersonate identities without needing to steal private keys. Microsoft addressed this vulnerability (CVE-2026-34348) in its July 2026 security update, which truncates signature fields in logged assertions to enhance security.
However, the risk extends beyond assertion replay. Researchers demonstrate how local malware can misuse WebAuthn APIs for deceptive authentication prompts, exploiting techniques such as prompt flooding and application identity spoofing.
Mitigation and Future Outlook
To mitigate these risks, it is crucial for organizations to apply timely security updates and enforce robust server-side replay protections. Monitoring local WebAuthn execution and requiring hardware-backed passkey attestation for high-privilege accounts are recommended practices.
Despite these vulnerabilities, passkeys, particularly those bound to hardware tokens, remain a more secure alternative to traditional passwords. Organizations are urged to strengthen their security posture by adopting comprehensive controls and continuously auditing their systems.
The ongoing research by SpecterOps and the proactive measures by Microsoft underscore the importance of vigilance and adaptation in cybersecurity strategies. As threats evolve, so must the defenses against them, ensuring the integrity and security of authentication processes.
