Microsoft Passkey Implementation Flaws Echo Old Attack Vectors
Researchers have uncovered vulnerabilities in Microsoft's passkey implementation that could allow attackers to impersonate privileged users, demonstrating that older attack methods remain relevant.
Researchers have identified significant security flaws in Microsoft's implementation of passkeys, a modern authentication method designed to be phishing-resistant and more secure than traditional passwords. The vulnerabilities, discovered by Michael Grafnetter, a principal security researcher at SpecterOps, could allow attackers to impersonate privileged users and bypass multi-factor authentication (MFA) by leveraging techniques reminiscent of older Windows hacking methods.
These findings are particularly timely as Microsoft plans to make passkeys the default sign-in method for Microsoft Entra ID starting September 1st. While passkeys themselves, based on the WebAuthn standard, are cryptographically sound, their surrounding implementation can introduce critical weaknesses. Grafnetter's research highlights that flaws in how these systems are built and integrated can reintroduce attack paths that were thought to be mitigated by the shift to passwordless authentication.
The research uncovered three "nearly exploitable" zero-day vulnerabilities affecting Windows 11 and Microsoft Entra ID. Two of these vulnerabilities form a chain that Grafnetter has dubbed "Pass-the-Passkey." This attack mirrors older techniques like pass-the-hash and NTLM relay, where attackers steal and reuse authentication credentials. In this new scenario, attackers could potentially reuse passkey assertions without needing the user's actual credentials or even direct access to the device.
According to Grafnetter, the core issue lies in how Windows 11 was writing passkey data to the event log, essentially creating a copy of the digital key. Compounding this, Microsoft Entra ID failed to adequately prevent the reuse of these assertions. This combination means that organizations relying on Windows Hello or FIDO2 security keys with Entra ID are particularly exposed to these risks. The implications are serious, as successful exploitation could grant attackers privileged access to cloud identities while circumventing phishing-resistant MFA.
Microsoft has since deployed a silent mitigation in its cloud services, which Grafnetter discovered while preparing for his Black Hat USA presentation. The primary Windows passkey vulnerability was assigned CVE-2026-34348, a protection mechanism failure in the Windows Event Logging Service. This was patched by Microsoft on July 14th, just before the Black Hat conference, indicating the company's awareness and response to the disclosed flaws.
Grafnetter emphasized that the problem is not with the passkey standard itself, but with incomplete or incorrect implementations. He advises developers to utilize well-tested WebAuthn frameworks rather than attempting custom builds, given the complexity of passkey validation. "One uncomfortable lesson from our research is that even Microsoft, one of the co-authors of the standard, missed some of the WebAuthn assertion validation steps required by the specification," he stated.
Despite these findings, Grafnetter remains optimistic about the future of passkeys, stressing that they still represent a significant improvement over traditional passwords. The discovered attack paths are considerably more complex than those used for password-based attacks. He recommends that organizations prioritize device-bound passkeys, enforce attestation, and avoid relying solely on phishing-resistant MFA. Strong endpoint security and robust server-side validation remain critical components of a secure passkey strategy.
The research serves as a crucial reminder that while new technologies like passkeys offer enhanced security, they are not immune to exploitation. Vigilance in implementation, continuous security research, and prompt patching remain paramount in defending against evolving cyber threats, even those that echo older attack methodologies.