Passkeys Aren't Magic: Researchers Map 39 Ways to Sidestep Them
A new catalogue from Token shows attackers don't need to break the cryptography behind passkeys to steal accounts. They just walk around it.
Key points
- Researchers at Token have documented 39 ways to defeat passkey logins without breaking the underlying cryptography.
- The attacks target enrollment, recovery, synced credentials and the login prompt itself, not the FIDO2 standard behind passkeys.
- Passkeys still remove most password-based risks, including credential stuffing and mass phishing, but they are not a total fix.
- Weak account recovery, where users can fall back to a password or a text message, remains the softest target.
- Organisations rolling out passkeys need to lock down enrollment and recovery, not just the login screen.
Passkeys were sold as the end of the password era. A new writeup, first reported by BleepingComputer, is a useful reminder that the login box is only one part of the story.
Security firm Token has published a catalogue of 39 techniques that criminals can use to bypass passkey logins. None of them break the cryptography. They all pick the locks around it.
What is a passkey, in plain English?
A passkey is a login method that replaces your password with a secret stored on your phone or laptop, unlocked by your fingerprint or face. It's built on a standard called FIDO2, designed by an industry group to stop the classic tricks: guessing passwords, stuffing stolen ones into other sites, or phishing them through fake login pages.
The cryptography works. Token isn't arguing otherwise. What the researchers describe is closer to a burglar who doesn't pick the front-door lock. He rings the bell, pretends to be the cleaner, and gets let in.
How do the 39 attacks actually work?
They abuse the trust boundaries around the passkey, not the passkey itself. Think of the moments when a site has to make a judgement call about who you are: setting up the passkey in the first place, recovering your account when you lose your phone, syncing credentials to a new device, or showing you a login prompt you didn't ask for.
Token groups the techniques into a handful of buckets:
| Attack surface | What goes wrong |
|---|---|
| Enrollment | An attacker registers their own passkey on your account before you do |
| Recovery | The "I lost my device" flow falls back to a password or a text message |
| Synced credentials | A compromised cloud account hands over the passkey |
| Login prompts | Users are tricked into approving a login they didn't start |
| Session handling | Attackers steal the cookie issued after a valid passkey login |
None of this is exotic. Session cookie theft is as old as web banking. Tricking someone into approving a prompt is the same pattern that broke Uber and Cisco in 2022, only with a different button to tap. The enrollment angle is one we've tracked closely: on 21 August 2026 we reported on iAuthFlow V2, a toolkit that plants an attacker-controlled passkey inside your account so that a password reset does nothing to lock them out.
Should ordinary users worry?
Not much, and definitely not enough to go back to passwords. Passkeys still kill off the biggest categories of account theft, bulk phishing and reused-password attacks among them. If your bank or your email provider offers a passkey, turn it on.
The practical advice is short. Be suspicious of any login prompt that appears when you weren't trying to log in. If a site lets you delete the old password after adding a passkey, do it. Keep whichever cloud account stores your passkeys protected with a strong second factor of its own.
What should companies rolling out passkeys do?
Stop treating the login screen as the whole problem. Most of Token's 39 techniques hit enrollment and recovery, the two flows that engineers tend to design last and test least.
That means checking who is allowed to register a passkey on an account, and when. It means killing password fallbacks once a passkey exists, or at least gating them behind something stronger than an SMS code. Logging and alerting on passkey changes matters as much as it does on a password reset.
The headline number, 39, will get the clicks. Authentication is a system, not a login box, and passkeys only fix the parts you actually plumb in properly. That's the part worth writing down.
