Pass-the-Passkey Attack Lets Adversaries Impersonate Users and Bypass MFA in Windows 11, Entra ID

Security researchers described a new attack family called “Pass-the-Passkey” that enables adversaries to impersonate enterprise users and bypass phishing-resistant multi-factor authentication (MFA) protections in Windows 11 and Microsoft Entra ID environments.

“a new attack family named “Pass-the-Passkey””

GBHackers News

The research says the attack does not involve extracting a passkey’s private cryptographic key from a FIDO2 security key, Windows Hello container, or other trusted hardware, and instead exploits weaknesses in WebAuthn implementation and validation workflow.

9to5Google

Researchers at SpecterOps found that Windows 11 could log complete WebAuthn assertion responses in the Microsoft-Windows-WebAuthN/Operational event log, and that in certain scenarios low-privilege users, and sometimes even remote users with access to the event log, could retrieve assertion data generated during another user’s passkey login.

The second part of the attack chain relates to Microsoft Entra ID’s server-side passkey validation, where the research says Entra ID did not adequately enforce key WebAuthn anti-replay controls including challenge uniqueness, session binding, and signature-counter verification.

Microsoft has reportedly addressed the Windows logging issue, tracked as CVE-2026-34348, by truncating logged signatures as of July 2026.

A Microsoft spokesperson told The Hacker News that the company has applied mitigations for the reported issue involving passkey relay assertions and recommended “adopting a least-privilege access approach, using phishing-resistant authentication methods, and maintaining endpoint protections by embracing a Zero Trust security model.”

The Hacker News also quoted SpecterOps saying it has not retested the Entra replay vulnerability since June, but that the firm now considers the full Windows-to-Entra vulnerability chain broken because Microsoft’s July 2026 Windows updates make the WebAuthn assertions written to event logs unusable for replay attacks.

Ars Technica

The research described by GBHackers News says the Windows exposure was assigned CVE-2026-34348 as an information-disclosure vulnerability in the Windows Event Logging Service, with Microsoft giving it a CVSS 3.1 score of 6.5.

Ars Technica reported that Palo Alto Networks researcher Arie Olshtein described “Pass-ta-key” as a novel attack surface, but Ars Technica said the attacks demonstrated in the post are neither novel nor unique to passkeys.

Ars Technica also noted that FIDO 2 specifications do not mandate that passkeys be kept in TPMs, and that virtually the lone holdout is Microsoft, which gives users the option to store passkeys in the Windows TPM.

The GBHackers News coverage says defenders are advised to limit unnecessary access to Windows event logs, review memberships in the Event Log Readers and remote-management groups, and monitor any unusual access to the WebAuthn Operational log.

“limit unnecessary access to Windows event logs”

GBHackers News

It also says Entra ID administrators should prioritize device-bound, hardware-backed passkeys for high-value accounts, require attestation when practical, and avoid using shared user endpoints for privileged identities.

The Cyber Press article adds that Microsoft addressed the Windows logging weakness as CVE-2026-34348 in its July 14, 2026 security updates, and that patched systems truncate the signature component stored in the log to six bytes.

The Hacker News reported that as of August 10, SpecterOps said Entra still uses JSON Web Tokens (JWTs) as WebAuthn challenges rather than pseudorandomly generated nonces and does not appear to bind WebAuthn challenges to session cookies.

Ars Technica framed the broader risk as confusion about whether passkeys are truly safe, while also describing how Pass-ta-key could obtain all passkeys stored in the Google Password Manager app (GPM) for Windows when it’s running on a machine infected with malware.