39 New Methods That Compromise Passkey Authentication
Researchers document 39 methods to compromise passkey authentication without breaking FIDO2 cryptography.
While passkeys offer enhanced security over traditional passwords, researchers have identified 39 documented methods to compromise authentication systems built around them. These attacks exploit trust boundaries in the authentication process, such as enrollment, recovery, and user verification, rather than breaking the underlying FIDO2 cryptography. SpecterOps research highlights that malware can manipulate the WebAuthn infrastructure to generate signed assertions, allowing attackers to authenticate without ever accessing the private key.
AI summary of the linked source. Not reviewed by an editor. How this works
Run FIDO2?
Get an email when a new story names FIDO2, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearchers have identified 39 methods to compromise passkey-based authentication systems by exploiting trust boundaries in enrollment, recovery, and user verification workflows — not by breaking FIDO2 cryptography itself. This is critical because organizations adopting passkeys may develop a false sense of security, believing the underlying cryptographic standard alone is sufficient protection. Malware can manipulate WebAuthn infrastructure to generate signed assertions, effectively allowing attackers to authenticate without ever touching the private key. The root cause lies in misconfigured or insufficiently hardened authentication pipelines and inadequate controls around the processes that surround the cryptographic core. This highlights that strong algorithms alone cannot compensate for weak implementation and operational security around authentication systems.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.