2026-08-16 · view entry permalink →
UPDATE — the fourth passkey attack thread this pipeline could not source last week is now documented, and it closed: Windows cached YubiKey assertions in cleartext where any authenticated user could read them, and the July updates broke the chain
UPDATE · originally covered Three independent disclosures in one week attacked passkeys from both ends — the cryptography on a compromised endpoint and the enrolment on the phone — and the enterprise path, borrowing a signed-in session's Windows Hello key to authenticate to Entra ID, carries no CVE and no fix (2026-08-09)
the prior weekly covered three independent attacks on passkeys — forged Chrome synced-passkey assertions, a vishing pretext built around urgent FIDO2 enrolment, and borrowing a signed-in session's Windows Hello key to authenticate to Entra ID — and dropped a fourth because the sentence naming it could not be traced to any source that ran in that window. The delta is that the fourth thread now has a citable account, and it does not read the way an unsourced fragment implied.
SpecterOps principal security researcher Michael Grafnetter presented the firm's Pass-the-Passkey research at Black Hat USA 2026 on 5 August. The mechanism is distinct from the Windows Hello work the prior entry already carried: rather than using a hardware-bound key from a live session, it starts from stored material. "SpecterOps says Windows stored past YubiKey signatures in cleartext where authenticated unprivileged users, including remote users, could read them," and "The firm says chaining those signatures with weaknesses in Microsoft Entra ID's passkey validation allowed privileged-user impersonation despite policies requiring phishing-resistant multifactor authentication" (The Hacker News, 2026-08-10). Two properties make that worth recording even now that it is fixed. The read required no elevation — an ordinary authenticated account, including one arriving over a remote session, was sufficient. And the replay succeeded against a policy that was doing exactly what it was configured to do, because the assertion it accepted was genuine; nothing about the cryptography failed.
The correction is the outcome, and it runs opposite to the direction an open-ended reading would suggest. Microsoft's Windows-side flaw is tracked as CVE-2026-34348 with a vendor CVSS of 6.5 and was fixed in the July 2026 updates — before the research was presented. SpecterOps told the outlet it has not retested the Entra side since June, but "the firm now considers the full Windows-to-Entra vulnerability chain broken because Microsoft's July 2026 Windows updates make the WebAuthn assertions written to event logs unusable for replay attacks," and Microsoft stated it has also applied mitigations for the reported issue involving passkey relay assertions. So the honest status is closed on the researcher's own assessment, not open.
Triage: where an estate has not yet deployed the July updates, the observable is reading rather than writing — access to Windows event-log records containing WebAuthn or FIDO2 assertion data by an account that is neither an administrator nor a monitoring agent, and particularly from a remote session. That is worth separating from the ordinary case carefully: log collection agents and administrators read these channels constantly and legitimately, so the account class and the session type are the discriminators, not the read itself. On the Entra side, the sign-in telemetry shape that would correspond to a successful replay is an authentication satisfying a passkey or FIDO2 requirement for a user from a device or session with no prior passkey-registration history for that user — a mismatch between the authentication method claimed and the registration record that should underlie it.
SpecterOps says Windows stored past YubiKey signatures in cleartext where authenticated unprivileged users, including remote users, could read them.
The firm says chaining those signatures with weaknesses in Microsoft Entra ID's passkey validation allowed privileged-user impersonation despite policies requiring phishing-resistant multifactor authentication
the firm now considers the full Windows-to-Entra vulnerability chain broken because Microsoft's July 2026 Windows updates make the WebAuthn assertions written to event logs unusable for replay attacks.