● Covered by 1 source · 1 reportMedium impact1 negative
Researchers Identify 39 Methods to Compromise Passkey Authentication
Key points
- 39 documented methods to compromise passkey authentication exist.
- Attacks target infrastructure and user interaction, not FIDO2 cryptography.
- Proof-of-concept tools and research are publicly available.
- Malware can obtain signed assertions without extracting private keys.
Passkey Security Under Scrutiny
Passkeys were introduced to enhance security by replacing passwords with public key cryptography, binding credentials to services, and keeping private keys off servers. This design aimed to significantly reduce phishing and credential theft attacks. However, the security landscape for passkeys is evolving rapidly.
Emergence of New Attack Vectors
There are now at least 39 publicly documented methods, attack paths, and exploitation scenarios targeting passkeys and their surrounding infrastructure. Many of these techniques have working proof-of-concept tools or published research detailing their execution. Some are already appearing in real-world attack patterns, indicating that attackers have access to a growing playbook of vulnerabilities.
Focus Shifts Beyond Cryptography
The research reveals a critical distinction: while the FIDO2 cryptography itself may remain intact, the account protected by the passkey can still be compromised. Modern passkey authentication involves numerous trust boundaries, including web applications, browsers, operating systems, password managers, cloud services, and human approval processes. Researchers are targeting nearly every one of these layers.
Examples of Exploitation Techniques
Published techniques include assertion mining, assertion replay, circuit breaker attacks, assertion phishing, browser hooking, assertion capture, challenge injection, detour replay, user verification manipulation, and user presence manipulation. SpecterOps' "Pass the Passkey" research demonstrated that malware can obtain a signed assertion from the legitimate WebAuthn infrastructure without extracting the private key. This occurs when a malicious Windows application prompts a user for verification, and the user unknowingly approves the authentication, providing the attacker with the assertion.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
New research has documented at least 39 methods and attack paths that can compromise passkey authentication, despite the underlying FIDO2 cryptography remaining secure. These vulnerabilities often target the surrounding infrastructure and user interaction rather than the cryptographic keys themselves, highlighting a shift in attack vectors for passkey-protected accounts.