Microsoft's New Passkey System Has Flaws That Let Old Hacking Tricks Work Again
A security researcher found three near-exploitable bugs in Windows 11 and Microsoft's cloud login service, just as the company prepares to make passkeys the default sign-in method for hundreds of millions of users.
Key points
- Security researcher Michael Grafnetter of SpecterOps found three near-exploitable vulnerabilities in Windows 11 and Microsoft Entra ID, Microsoft's cloud-based login service, affecting how passkeys are handled.
- The main flaw, CVE-2026-34348, caused Windows to write a full copy of a user's passkey credential to an internal log file, where an attacker could steal and replay it.
- Microsoft patched CVE-2026-34348 on 14 July 2026 and quietly fixed a related cloud-side flaw without a public announcement.
- Microsoft plans to make passkeys the default sign-in method for Entra ID from 1 September 2026.
- Grafnetter still recommends passkeys over passwords, but says endpoint security and server-side validation matter as much as the passkey itself.
Passkeys are the technology the entire industry has been banking on to replace passwords. Instead of typing a secret, your device recognises you by fingerprint, face, or PIN and generates a secure digital proof of identity on the spot. No password to steal, no password to forget. Microsoft is so confident in them that from 1 September 2026, passkeys will become the default sign-in method for Microsoft Entra ID, the company's cloud-based service that controls who gets access to corporate apps and data worldwide. We covered the full scope of that rollout on 14 July, in our report on Microsoft killing SMS logins for business accounts.
The timing makes new research from SpecterOps principal security researcher Michael Grafnetter particularly awkward for Microsoft.
How did the researcher find the problem?
Grafnetter was studying passkey security ahead of a presentation at Black Hat USA in Las Vegas next month. He found three bugs, two of which chain together to let an attacker impersonate a high-privilege user and bypass MFA (multi-factor authentication, the extra confirmation step such as a code sent to your phone) even though passkeys are supposed to make that kind of attack impossible.
He calls the combined technique "Pass-the-Passkey", after older Windows attacks like pass-the-hash, where criminals steal a scrambled version of a password and reuse it directly without ever knowing the real one.
The root cause is blunt. Windows 11 was writing a complete copy of the passkey assertion (the digital proof your device sends to confirm your identity) to an event log, an internal diary the operating system keeps of its own activity. Anyone who could read that log could grab the credential and replay it elsewhere. Entra ID then failed to reject those replayed credentials, making the two bugs a working chain.
| Detail | Facts |
|---|---|
| CVE ID | CVE-2026-34348 |
| Affected product | Windows 11 / Windows Event Logging Service |
| What it allows | Credential disclosure over a network |
| Cloud-side flaw | Entra ID replay validation failure |
| Patch date (Windows) | 14 July 2026 |
| Cloud fix | Deployed silently by Microsoft, no public date given |
"One uncomfortable lesson from our research is that even Microsoft, one of the co-authors of the standard, missed some of the WebAuthn assertion validation steps required by the specification," Grafnetter said. WebAuthn is the technical standard, developed by the World Wide Web Consortium and the FIDO Alliance, that underpins how passkeys work across every major platform.
Microsoft fixed the cloud side quietly. Grafnetter only noticed the fix while recording video demos for his Black Hat talk.
Should ordinary users and businesses be worried?
Not panicked, but paying attention. The attack paths Grafnetter describes are far more complicated than simply guessing or phishing a password, so the bar for criminals is still higher than it was in the password era. Organisations using Windows Hello (Microsoft's fingerprint and face login system built into Windows) or physical security keys such as YubiKeys alongside Entra ID should apply the 14 July 2026 Windows updates immediately. Restricting who can read event logs remotely and limiting code execution on privileged machines also cuts exposure.
For high-value accounts, Grafnetter recommends device-bound passkeys rather than ones that sync across cloud accounts, and not treating MFA as the only protective layer.
"Passkeys are still a major improvement over passwords, but they are not magic," he told Dark Reading. "The attack paths we describe remain much more complex than those in traditional password attacks, so we continue to recommend adopting passkeys."
The underlying cryptography of passkeys is sound. What breaks is the plumbing around them. That's the real lesson here: a well-designed standard only holds if every layer of implementation follows through, and this research shows that even the vendors who wrote the rules can fall short.
