Technology and Science · 03 August, 2026 · 3 min read
Pass-the-Passkey Attack Lets Adversaries Impersonate Users and Bypass MFA in Windows 11, Entra ID
Malware can hijack Google-synced passkeys to impersonate enterprise users. Pass-the-Passkey techniques bypass phishing-resistant MFA on Windows 11 and Entra ID.
Ars Technica and The Hacker News frame the threat as mostly limited.
4 of 5 outlets skipped it: FIDO2/WebAuthn does not require passkeys be stored in TPM/secure enclaves.
14outlets compared
Same story, two versions
tap a side to read it in full
The Hacker News
“only attack chain broken because Microsoft's July 2026 Windows updates make the WebAuthn assertions written to event logs unusable for replay attacks.”Read the original ↗
Ars Technica
“the attacks demonstrated in the post are neither novel nor unique to passkeys.”Read the original ↗
One outlet questions impact; another downplays novelty.
Pass-the-Passkey chain
Security researchers described a new attack family called “Pass-the-Passkey” that enables adversaries to impersonate enterprise users and bypass phishing-resistant multi-factor authentication (MFA) protections in Windows 11 and Microsoft Entra ID environments. The research says the attack does not involve extracting a passkey’s private cryptographic key from a FIDO2 security key, Windows Hello container, or other trusted hardware, and instead exploits weaknesses in WebAuthn implementation and validation workflow. Researchers at SpecterOps found that Windows 11 could log complete WebAuthn assertion responses in the Microsoft-Windows-WebAuthN/Operational event log, and that in certain scenarios low-privilege users, and sometimes even remote users with access to the event log, could retrieve assertion data generated during another user’s passkey login.
The second part of the attack chain relates to Microsoft Entra ID’s server-side passkey validation, where the research says Entra ID did not adequately enforce key WebAuthn anti-replay controls including challenge uniqueness, session binding, and signature-counter verification. Microsoft has reportedly addressed the Windows logging issue, tracked as CVE-2026-34348, by truncating logged signatures as of July 2026.
What Microsoft and SpecterOps say
A Microsoft spokesperson told The Hacker News that the company has applied mitigations for the reported issue involving passkey relay assertions and recommended “adopting a least-privilege access approach, using phishing-resistant authentication methods, and maintaining endpoint protections by embracing a Zero Trust security model.” TThe Hacker News also quoted SpecterOps saying it has not retested the Entra replay vulnerability since June, but that the firm now considers the full Windows-to-Entra vulnerability chain broken because Microsoft’s July 2026 Windows updates make the WebAuthn assertions written to event logs unusable for replay attacks. TThe research described by GBHackers News says the Windows exposure was assigned CVE-2026-34348 as an information-disclosure vulnerability in the Windows Event Logging Service, with Microsoft giving it a CVSS 3.1 score of 6.5.
Ars Technica reported that Palo Alto Networks researcher Arie Olshtein described “Pass-ta-key” as a novel attack surface, but Ars Technica said the attacks demonstrated in the post are neither novel nor unique to passkeys. AArs Technica also noted that FIDO 2 specifications do not mandate that passkeys be kept in TPMs, and that virtually the lone holdout is Microsoft, which gives users the option to store passkeys in the Windows TPM.A
Mitigations and what’s at risk
The GBHackers News coverage says defenders are advised to limit unnecessary access to Windows event logs, review memberships in the Event Log Readers and remote-management groups, and monitor any unusual access to the WebAuthn Operational log. It also says Entra ID administrators should prioritize device-bound, hardware-backed passkeys for high-value accounts, require attestation when practical, and avoid using shared user endpoints for privileged identities. The Cyber Press article adds that Microsoft addressed the Windows logging weakness as CVE-2026-34348 in its July 14, 2026 security updates, and that patched systems truncate the signature component stored in the log to six bytes.
The Hacker News reported that as of August 10, SpecterOps said Entra still uses JSON Web Tokens (JWTs) as WebAuthn challenges rather than pseudorandomly generated nonces and does not appear to bind WebAuthn challenges to session cookies. TArs Technica framed the broader risk as confusion about whether passkeys are truly safe, while also describing how Pass-ta-key could obtain all passkeys stored in the Google Password Manager app (GPM) for Windows when it’s running on a machine infected with malware.A