Passkey Bypass: Three Studies Shatter FIDO2's 'Anti-Phishing'…

On August 3, 2026, researchers from SpecterOps, Palo Alto Networks Unit 42, and independent researcher Dirk-jan Mollema published distinct, converging techniques that bypass passkey protections on Microsoft and Google platforms. None of the three studies break the underlying FIDO2/WebAuthn cryptography; all abuse surrounding implementation controls, from Windows storing signatures in cleartext to Google Password Manager exposing the master key in memory. The findings arrive as Microsoft accelerates its passwordless transition with a September 2026 deadline and SMS retirement in February 2027.

Key Takeaways

CVE-2026-34348: Windows Event Logging Service stores WebAuthn assertions in cleartext, enabling replay on Entra ID with non-privileged users; Microsoft has released patches and mitigations.
Unit 42 demonstrated three "Pass-ta-key" variants against Google Password Manager in Chrome, including recovery of the 32-byte Security Domain Secret from process memory during re-registration.
Dirk-jan Mollema published a PowerShell PoC that abuses Windows Hello for Business keys from a compromised session without a new PIN or biometric, generating fresh, valid assertions on Entra.
All attacks require malware already present on the endpoint; none work from unauthenticated remote access or break FIDO2 cryptographic math.

Windows Spies on Itself: Cleartext in the Logging Service

SpecterOps demonstrated a Windows-to-Entra ID chain that allows impersonation of privileged users while satisfying phishing-resistant MFA requirements. The vector is the Windows Event Logging Service, which stores previous passkey signatures in cleartext accessible to authenticated non-privileged users, including remote users. The attacker reuses this signed material without extracting the private key from the hardware authenticator.

The issue is tracked as CVE-2026-34348, an information disclosure vulnerability with a CVSS 6.5 MEDIUM score according to the National Vulnerability Database (vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Microsoft has released a security update and applied mitigations for passkey relay assertions; SpecterOps considers the full chain "broken" after the July 2026 updates. The NVD record classifies the weakness as CWE-693, protection mechanism failure.

An architectural element amplifies the risk: Entra ID uses JWTs as WebAuthn challenges. This choice makes assertions reusable in replay, since the JWT is not strictly bound to the originating session. SpecterOps presented the findings at Black Hat USA 2026 on August 5.

Google Password Manager: The Master Key That Cannot Be Rotated

Unit 42, Palo Alto Networks' research team, demonstrated three attacks dubbed Pass-ta-key against Google Password Manager in Chrome on Windows. The "Golden" variant is the most severe: it recovers the Security Domain Secret (SDS), the 32-byte master key that protects all of the user's synced passkeys.

The SDS is temporarily present in Chrome process memory during re-registration, despite Google fixing the exposure in logs. The demonstrations were developed and validated on Chrome 142; aside from the fixed logging issue, the attacks worked on the stable version at the time of research. Arie Olshtein, senior staff security researcher at Palo Alto Networks, stated via The Hacker News: "No CVE was assigned. Google rarely assigns CVEs to issues that require the device to already be compromised by malware."

The most relevant architectural limit for users: Google offers no way to rotate or revoke a compromised SDS. The brief does not specify whether the exposed SDS survives a Google Password Manager PIN change or data deletion.

Windows Hello for Business: The TPM That Stops Asking for Proof

Dirk-jan Mollema demonstrated that malware in an already compromised Windows session can use the TPM-protected Windows Hello for Business key without producing a new PIN or biometric prompt. A low-privilege process calls Windows cryptographic interfaces to generate fresh WebAuthn assertions, satisfying Conditional Access rules that require phishing-resistant authentication.

The Entra WebAuthn challenge is valid for 5 minutes and is not bound to session, user, or tenant. The attacker can request it on a controlled system and have it signed on the victim machine. The resulting token may lack a device ID claim, allowing device registration and acquisition of a Primary Refresh Token with a 90-day validity, continuously renewable. Mollema published the PowerShell PoC in the ROADtools repository.

The brief does not specify which Windows builds or Windows Hello for Business deployment models were tested, nor whether a dedicated CVE or Microsoft advisory exists.

"None cracked the math" — The Hacker News summarizes the common denominator: FIDO2/WebAuthn cryptography remains intact; the security plumbing around it does not.

What to Do Now

Organizations rolling out passkeys as a passwordless replacement must act on four fronts documented in the dossier:

Patch CVE-2026-34348: Apply the Microsoft July 2026 updates that fix cleartext logging and Entra-side mitigations.
Enforce userVerification=required: eBay fixed UV flag validation after disclosure; GitHub already enforces it. Verify that your internal and external services do not accept assertions with a bypassable UV flag.
Monitor for anomalous device registrations: An Entra token missing a device ID claim is an indicator of Windows Hello for Business abuse from a compromised session.
Treat browser memory and passkey stores as credential-sensitive territory: The 32-byte SDS in Chrome memory requires the same level of protection reserved for traditional credentials.

Microsoft's Rush and the Risk of Forced Transition

The timing is politically relevant. Microsoft has set a September 2026 mandate for passkeys for enterprise access and a February 2027 retirement of SMS and voice call MFA. The research published August 3 shows that both synced and device-bound passkeys present implementation attack surfaces on compromised endpoints.

The problem is not the FIDO2 protocol, but the promise that it works independently of the maturity of the surrounding layers: operating systems that log in cleartext, browsers that hold master keys in memory without rotation, cloud identity that accepts unbound challenges. The passwordless transition risks replacing weak passwords with weakly guarded passkeys.

The brief does not specify whether Microsoft Entra-side mitigations are technically documented or only applied without publication, nor whether SpecterOps retested the replay vulnerability after June 2026.

Why Google's SDS Cannot Be Rotated

The absence of a rotation or revocation mechanism for the Google Password Manager Security Domain Secret creates a persistent risk asymmetry. Even after the logging fix, the SDS remains temporarily exposed in memory during re-registration. Users cannot invalidate a potentially compromised SDS without migrating entirely to a new Google account — an impractical option for enterprise or legacy accounts.

This architectural choice turns memory recovery from a transient vulnerability into a structural weakness: the attacker who obtains the SDS gains retroactive and future access to all synced passkeys, with no possibility of user-side revocation.

Information verified against cited sources and current as of publication.

Sources

Sources and references