Pass-the-Passkey Attack Chain Exposes Windows 11 and Entra ID Vulnerabilities

For years, the cybersecurity community has hailed passkeys and the FIDO2/WebAuthn standard as the ultimate cure for the identity crisis that has plagued enterprise networks for decades. By replacing static passwords with origin-bound, asymmetric public-key cryptography tied to local biometrics or hardware security keys, passkeys effectively stripped threat actors of their most reliable weapon: credential harvesting and adversary-in-the-middle (AiTM) phishing. As major cloud identity providers like Microsoft prepare to make passkeys the default authentication mechanism for Microsoft Entra ID starting in September 2026, the transition toward a passwordless enterprise architecture appeared nearly complete. However, recent security research from SpecterOps principal security researcher Michael Grafnetter serves as a stark reminder that even the most robust cryptographic standards can be undermined by operational implementation flaws. Dubbed “Pass-the-Passkey”, this novel attack chain demonstrates how subtle oversights in operating system telemetry and cloud-side token validation can allow adversaries to bypass phishing-resistant multi-factor authentication (MFA) and hijack privileged cloud accounts without ever possessing the victim’s physical device or biometric key.

Unveiled ahead of the Black Hat USA 2026 conference, the research exposes a multi-stage attack pathway targeting Windows 11 and Microsoft Entra ID environments. At the core of the chain is CVE-2026-34348, a protection mechanism failure within the Windows Event Logging Service that inadvertently exposed sensitive authentication payloads. When paired with inadequate replay validation controls in the cloud, the flaw permitted attackers to capture passkey assertion data locally and replay it to authenticate against enterprise services. The disclosure highlights a fundamental reality of modern identity security: while the mathematical foundation of FIDO2 remains unassailable, the software ecosystem surrounding its execution remains vulnerable to classic post-exploitation patterns.

Anatomy of the “Pass-the-Passkey” Attack Chain

To understand the mechanics of the Pass-the-Passkey attack, one must first look at how WebAuthn and FIDO2 handle passwordless sign-ins. Under standard operation, when a user attempts to log into a cloud service such as Microsoft Entra ID, the relying party issues a cryptographic challenge. The user’s device uses its private key—stored securely inside a hardware security module (HSM), Trusted Platform Module (TPM), or secure enclave—to sign the challenge alongside contextual metadata, including the origin URL and a sign counter. This signed assertion is returned to the server, which verifies the signature against the registered public key before granting access. This architecture is designed to render intercepted credentials useless, as signed challenges are unique to each transaction.

The Pass-the-Passkey research revealed that flaws in system logging and session management disrupted this security boundary. Specifically, the attack chain leveraged two distinct implementation failures working in tandem:

• Local OS Telemetry Exposure (CVE-2026-34348): In Windows 11 environments, the Windows Event Logging Service was found to be writing raw copies of passkey credential payloads and signed assertions directly into local system event logs. An attacker or malware possessing local unprivileged or low-privileged access on a workstation could monitor these logs to harvest valid passkey signatures without needing elevated administrative rights or physical access to the underlying TPM or biometric sensor.
• Cloud-Side Replay Vulnerability: Concurrently, Microsoft Entra ID lacked sufficient validation mechanisms to enforce strict single-use limits or session-specific binding on incoming WebAuthn signed assertions. Because the cloud service failed to reject replayed assertion payloads across different sessions or contextual requests, an adversary could take the harvested credential data from the event logs and submit it to Entra ID directly.

By marrying local telemetry harvesting with improper cloud token validation, the attack chain achieved account takeover while completely bypassing phishing-resistant MFA controls. Crucially, the adversary never needed to crack private cryptographic keys or defeat biometric sensors—they simply reused valid, signed payloads generated by legitimate user logins.

Why Implementation Flaws Echo Historic Pass-the-Hash Mechanics

The naming convention of Pass-the-Passkey is a deliberate nod to Pass-the-Hash (PtH) and NTLM Relay attacks—the classic post-exploitation techniques that dominated Active Directory compromise vectors for decades. In traditional Windows environments, Pass-the-Hash allowed attackers who compromised an endpoint to extract cached NTLM password hashes from memory and present them directly to distant network servers to authenticate, skipping the password cracking phase entirely.

The discovery of Pass-the-Passkey demonstrates how history repeats itself when high-level cryptographic protocols interface with legacy operating system architectures. The WebAuthn specification prescribes a rigorous 22-step validation process involving challenge-response verification, origin checking, and transaction processing. However, when software engineers integrate these complex cryptographic workflows into broad enterprise platforms like Windows 11 and Entra ID, subtle state-handling errors and logging oversights can reintroduce the exact replay vulnerabilities that passkeys were designed to eliminate. The threat vector merely shifts from harvesting raw password hashes in memory to harvesting signed WebAuthn assertions from event telemetry logs.

Synced Passkeys vs. Hardware Security Keys in Enterprise Identity

The disclosure of Pass-the-Passkey has reignited an essential architectural discussion within enterprise identity management: the distinction between synced passkeys and bound hardware security keys. While both leverage FIDO2 public-key cryptography, their underlying key storage mechanisms and threat models differ significantly across enterprise deployments.

Synced passkeys—which store private keys in cloud-managed vaults (such as Microsoft Entra ID, Apple iCloud Keychain, or enterprise password managers)—offer exceptional usability. They allow users to seamlessly authenticate across multiple devices without requiring manual key enrollment for every phone or laptop. For the vast majority of standard enterprise workers, synced passkeys represent a massive security upgrade over traditional passwords and SMS-based 2FA. However, because synced passkeys depend on endpoint software layers and cloud replication pipelines, they remain susceptible to software-based implementation flaws, endpoint credential harvesting, and local OS logging leaks.

Conversely, dedicated hardware security keys (such as YubiKeys) keep private keys permanently anchored inside tamper-resistant microcontrollers. The private key cannot be exported, synced, or backed up to local operating system storage, effectively immunizing them against endpoint event log harvesting vulnerabilities like CVE-2026-34348.

• Synced Passkeys: High usability and quick onboarding; suitable for standard enterprise personnel; private keys managed via cloud software vaults.
• Hardware Security Keys: Non-exportable, hardware-bound keys; immune to local OS logging leaks and endpoint credential scraping; essential for privileged administrative accounts.

The Fallback Paradox and Legacy Authentication Backdoors

While implementation flaws like CVE-2026-34348 represent sophisticated attack paths, identity security experts emphasize that a far more widespread risk during the passwordless transition is the “fallback paradox”. As organizations roll out passkeys, security teams often leave legacy password authentication, SMS one-time passcodes (OTPs), or weak self-service password reset (SSPR) workflows enabled to avoid locking out users who lose their devices.

Threat actors actively exploit these dual-state environments through authentication downgrade attacks. If an attacker cannot bypass a passkey directly, they manipulate the login process—often through prompt flooding, social engineering, or targeting helpdesk recovery channels—to force the authentication sequence back to legacy passwords or SMS MFA. A passwordless transition provides true phishing resistance only when legacy, phishable fallback mechanisms are systematically disabled across the tenant.

Enterprise Defense Strategies and Remediation Roadmap

Microsoft addressed the cloud-side replay vulnerability in Entra ID and officially patched the Windows 11 event logging flaw under CVE-2026-34348 during the July 14, 2026 update cycle. However, mitigating the broader risks highlighted by the Pass-the-Passkey research requires identity administrators and security operations teams to enforce end-to-end telemetry controls and policy guardrails.

1. Patch and Verify Windows Endpoints: Confirm that all Windows 11 hosts have received the July 2026 security updates to prevent raw passkey payload logging in the Windows Event Logging Service.
2. Audit System Logging Configurations: Audit local and centralized event logging policies (SIEM/XDR ingestion filters) to verify that sensitive authentication payloads, tokens, and challenge signatures are excluded from telemetry pipelines.
3. Tiered Authentication Policies: Enforce non-exportable hardware security keys (FIDO2 tokens) for all high-value administrative roles, restricting synced passkeys to general enterprise users.
4. Eliminate Legacy Fallbacks: Restrict legacy password sign-ins and eliminate SMS/Voice OTPs as secondary fallback options within Microsoft Entra ID Conditional Access policies.
5. Deploy Continuous Access Evaluation (CAE): Enable CAE and token binding controls in Entra ID to ensure that compromised or replayed tokens are invalidated instantaneously upon location or state changes.

Conclusion: Securing the Future of Passwordless Identity

The discovery of the Pass-the-Passkey attack chain by SpecterOps researcher Michael Grafnetter does not signal a failure of passkey technology, but rather a maturation of the identity security landscape. Passkeys remain the gold standard for defeating remote phishing and credential harvesting. However, as organizations migrate away from passwords, security teams must recognize that protocol strength is only as resilient as the surrounding software implementation. Securing enterprise identity in 2026 and beyond demands rigorous endpoint logging audits, strict session management, and the ruthless elimination of legacy authentication backdoors.