Pass-the-Passkey Attacks Expose Windows 11 and Microsoft Entra ID, Bypassing MFA

A new “Pass-the-Passkey” family of attack techniques demonstrates how systemic implementation flaws surrounding WebAuthn can undermine passkey security even when cryptographic private keys remain securely stored inside hardware tokens or trusted enclaves.

SpecterOps research highlights three core vulnerabilities across the WebAuthn ecosystem and over 20 distinct attack techniques impacting Windows 11, Microsoft Entra ID, web browsers, password managers, and enterprise authentication workflows.

Pass-the-Passkey Bypass Phishing-Resistant MFA

The primary attack chain identified by SpecterOps stems from Windows 11 logging complete, un-truncated WebAuthn assertion responses generated during passkey authentication events.

These sensitive assertions containing cryptographic signatures and authenticator data were written directly into Windows Event Logs.

An attacker with local or delegated access to a shared or compromised endpoint can harvest these assertions and replay them against authentication endpoints that lack rigorous anti-replay validation.

When privileged cloud administrators authenticate from compromised workstations, attackers can exfiltrate logged assertion material to impersonate those identities without needing to steal private keys.

Maintaining strict Windows 11 security controls is essential to prevent local log harvesting.

In a technical whitepaper published by SpecterOps, researchers disclosed that Microsoft Entra ID exacerbated the impact of assertion exfiltration by omitting essential WebAuthn anti-replay checks during server-side validation.

Specifically, Entra ID failed to:

• Verify challenge uniqueness or prevent challenge reuse across requests.
• Bind authentication challenges directly to individual user sessions.
• Track and evaluate authenticator signature counter increments.

Combining Windows assertion logging with Entra ID’s validation gaps enabled practical Passkey Replay Attacks that granted unauthorized access to privileged Microsoft cloud accounts while fulfilling phishing-resistant Multi-Factor Authentication (MFA) requirements.

Microsoft addressed the assertion logging vulnerability tracked as CVE-2026-34348 in its July 14, 2026 security release.

Fully patched Windows 11 systems truncate signature fields within logged assertions to six bytes, preventing assertion replay while preserving necessary diagnostic data for IT administrators.

Applying timely Windows security updates alongside kernel security hardening remains critical to mitigating local assertion exposure.

Beyond assertion replay, the research reveals that local malware can weaponize legitimate WebAuthn APIs to stage persuasive authentication prompts without extracting private key material.

Adversaries can pair WebAuthn API hooking with:

• Prompt Flooding: Repeatedly triggering credential prompts to induce user fatigue.
• Application Identity Spoofing: Altering caller parameters to mimic legitimate enterprise applications.
• Remote Desktop Pass-Through: Tunneling passkey requests across active RDP sessions.
• Credential UI Handle Spoofing: Overlapping malicious UI frames onto authentic Windows Credential UI windows.

Microsoft reviewed the reported Credential UI window handle spoofing technique and categorized it as a low-severity defense-in-depth issue.

To assist defenders in auditing their environments, SpecterOps released open-source utilities for assertion injection, event-log mining, and WebAuthn API hooking.

Component	Vulnerability / Technique	Risk & Impact
Windows 11 (CVE-2026-34348)	Full WebAuthn assertion logging in Event Viewer	Local information disclosure allowing assertion harvesting
Microsoft Entra ID	Missing challenge-binding and counter checks	Enables replay of harvested assertions to bypass MFA
Windows Credential UI	Window-handle spoofing and API manipulation	Facilitates local passkey phishing and prompt fatigue attacks

SpecterOps emphasizes that passkeys remain fundamentally superior to password-based authentication, particularly when device-bound hardware tokens are enforced. To mitigate passkey replay and UI spoofing risks, organizations should adopt the following controls:

• Keep OS Endpoints Updated: Ensure Windows 11 endpoints are patched past July 2026 to enforce signature truncation under CVE-2026-34348.
• Enforce Server-Side Replay Protections: Configure Relying Party (RP) servers to bind challenges to active user sessions and strictly track signature counters.
• Monitor Local WebAuthn Execution: Audit process telemetry for untrusted or unapproved applications invoking WebAuthn APIs.
• Enforce Attestation Policies: Require hardware-backed passkey attestation for high-privilege administrative accounts within Entra ID.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.