Pass-the-Passkey Attacks Expose Windows 11 and Microsoft Entra ID, Bypassing MFA

A new “Pass-the-Passkey” family of attack techniques demonstrates how systemic implementation flaws surrounding WebAuthn can undermine passkey security even when cryptographic private keys remain securely stored inside hardware tokens or trusted enclaves. SpecterOps research highlights three core vulnerabilities across the WebAuthn ecosystem and over 20 distinct attack techniques impacting Windows 11, Microsoft Entra ID, web browsers, password managers, and enterprise authentication workflows. Pass-the-Passkey Bypass Phishing-Resistant MFA WebAuthn Authentication Flow (Image Source: Specterops.io) The primary attack chain identified by SpecterOps stems from Windows 11 logging complete, un-truncated WebAuthn...

Read the full article at the source.