Microsoft's New Passkey System Has Flaws That Let Old Hacking Tricks Work Again
A security researcher found three near-exploitable bugs in Windows 11 and Microsoft's cloud login service, just as the company prepares to make passkeys the default for hundreds of millions of users.
Key points
- Security researcher Michael Grafnetter of SpecterOps found three near-exploitable vulnerabilities in Windows 11 and Microsoft Entra ID, Microsoft's cloud-based login service, affecting how passkeys are handled.
- The main flaw, CVE-2026-34348, caused Windows to write a full copy of a user's passkey credential to an internal log file, where an attacker could steal and reuse it.
- Microsoft patched CVE-2026-34348 on 14 July 2025 and quietly fixed a related cloud-side flaw without a public announcement.
- Microsoft plans to make passkeys the default sign-in method for Entra ID from 1 September 2025.
- Grafnetter still recommends passkeys over passwords, but says endpoint security and server-side checks matter as much as the passkey itself.
Passkeys are the technology the entire industry has been banking on to replace passwords. Instead of typing a secret phrase, your phone or laptop recognises you by your fingerprint, face, or PIN and generates a secure digital proof of identity on the spot. No password to steal, no password to forget. Microsoft is so confident in them that from 1 September 2025, passkeys will become the default sign-in method for Microsoft Entra ID, the company's cloud-based service that controls who gets access to corporate apps and data for organisations worldwide.
The timing makes new research from SpecterOps security researcher Michael Grafnetter particularly awkward for Microsoft.
How did the researcher find the problem?
Grafnetter was studying the security of passkeys ahead of a presentation at the Black Hat USA conference in Las Vegas next month. He found three bugs, two of which chain together in a way that lets an attacker impersonate a high-privilege user and bypass MFA (multi-factor authentication, the extra confirmation step such as a code sent to your phone) even though passkeys are supposed to make that kind of attack impossible.
He calls the combined technique "Pass-the-Passkey", after older Windows attacks like pass-the-hash, where criminals steal a scrambled version of a password and use it directly without ever knowing the real one.
The root cause is blunt. Windows 11 was writing a complete copy of the passkey assertion, the digital proof your device sends to confirm your identity, to an event log (an internal diary the operating system keeps of its own activity). Anyone who could read that log could grab the credential and replay it elsewhere. Entra ID then failed to reject those replayed credentials, making the two bugs a working chain.
| Detail | Facts |
|---|---|
| CVE ID | CVE-2026-34348 |
| Affected product | Windows 11 / Windows Event Logging Service |
| What it allows | Credential disclosure over a network |
| Cloud-side flaw | Entra ID replay validation failure |
| Patch date (Windows) | 14 July 2025 |
| Cloud fix | Deployed silently by Microsoft, no public date given |
"One uncomfortable lesson from our research is that even Microsoft, one of the co-authors of the standard, missed some of the WebAuthn assertion validation steps required by the specification," Grafnetter said. WebAuthn is the technical standard, developed by the World Wide Web Consortium and the FIDO Alliance, that underpins how passkeys work across every major platform.
Microsoft fixed the cloud side quietly. Grafnetter only noticed the fix while recording video demos for his Black Hat talk.
Should ordinary users and businesses be worried?
Not panicked, but paying attention. The attack paths Grafnetter describes are significantly more complicated than simply guessing or phishing a password, so the bar for criminals is still higher than it was in the password era.
That said, organisations using Windows Hello (Microsoft's fingerprint and face login system built into Windows) or physical security keys such as YubiKeys alongside Entra ID should apply the 14 July 2025 Windows updates immediately if they have not already. Restricting who can read event logs remotely and limiting code execution on privileged machines also reduces exposure.
For high-value accounts specifically, Grafnetter recommends using passkeys tied to a single physical device rather than ones that can sync across cloud accounts, and not treating MFA as the only protective layer.
"Passkeys are still a major improvement over passwords, but they are not magic," he told Dark Reading. "The attack paths we describe remain much more complex than those in traditional password attacks, so we continue to recommend adopting passkeys."
The underlying maths of passkeys remains sound. What breaks is the plumbing around them.
