Passkey security research reveals vulnerabilities in authentication implementations

Recent cybersecurity research has identified several methods to bypass or exploit passkey protections without breaking underlying cryptography. These vulnerabilities target the implementation and management of passkeys rather than the mathematical foundations of the technology.

One research effort by SpecterOps demonstrated a chain involving Windows and Microsoft Entra ID that could impersonate privileged users by reusing signed authentication material. Additionally, researchers from Unit 42 identified a path to recover private keys for synced passkeys within the Google Password Manager in Chrome. A separate finding by Dirk-jan Mollema showed that malware running in an active Windows session could utilize hardware-bound Windows Hello for Business keys without requiring a new biometric or PIN check.

Further analysis by Palo Alto Networks researcher Arie Olshtein clarified that these vulnerabilities, such as the “Pass-ta-key” attack, stem from how passkeys are stored. While many users assume passkeys are always stored in a Trusted Platform Module (TPM), FIDO 2 specifications do not mandate hardware-based storage. To enable cross-device syncing, many platforms store passkeys locally on the device rather than in dedicated secure hardware, which creates a different attack surface for malware already present on a system.