Pass-the-Passkey attacks just found a crack in passwordless security. Researcher Michael Grafnetter revealed the attack family at Black Hat USA on August 5, 2026. As a result, Windows 11 and Microsoft Entra ID both face real exposure.
Developers built passkeys to replace passwords and stop phishing for good. Because of this, millions of companies trusted them without a second thought. However, new vulnerabilities are now testing that trust. Therefore, security teams are scrambling to check systems they once assumed are safe.
The Pass-the-Passkey Attack That Shouldn’t Have Worked
Researchers uncovered more than 20 ways to attack passkeys. Surprisingly, none of them crack passkey encryption itself. Instead, attackers target the systems working quietly behind the scenes, like logs and identity checks.
Three major flaws sit at the center of the discovery. Notably, two of them combine into the most dangerous attack of all. As a result, a hacker can pretend to be someone else entirely, with no stolen password required. Since passkeys guard powerful business accounts, this combination turns a technical bug into real financial risk.
How a Logging Bug Became a Bypass
The trouble started with Windows 11, which stored a copy of login proof inside its event log. This proof, called a WebAuthn assertion, was never meant to be reused. Nevertheless, Windows saved it anyway. Microsoft tracked this flaw as CVE-2026-34348.
Meanwhile, Microsoft Entra ID made things worse on its own end. Specifically, Entra ID accepted that saved proof for up to ten minutes after login. In addition, it skipped basic checks meant to block reused logins.
Because of these two failures together, stolen proof became a working key. Consequently, anyone able to read the log, even with limited access, could walk straight through.
Why “Phishing-Resistant” Just Got Complicated
Attackers use an old trick called pass-the-hash here. In both cases, they never touch your secret. Instead, they simply reuse proof that you already logged in successfully. Once a system trusts that reused proof, it opens without asking further questions.
Furthermore, low-level malware can grab that proof quietly, without triggering a single alarm. From there, a minor breach can escalate quickly and grow into full control of a cloud account.
Entra ID promises phishing-resistant login, yet this bypass slips right past that promise. As a result, it hits hardest at businesses running sensitive cloud systems.
One Bug Down, One Still Open
Microsoft closed the Windows logging flaw in its July 2026 update. Therefore, old login proof can no longer be replayed. Even so, one of the three original flaws remains unpatched today.
In the meantime, Microsoft is urging companies to limit access and adopt stronger login methods. Additionally, it recommends constant system monitoring while that gap stays open. Meanwhile, time pressure is building fast. Microsoft plans to make passkeys the default login starting September 1.
Before that day arrives, organizations should patch their systems and check who can read their logs. Ultimately, passkeys still beat passwords by a wide margin but this situation proves no login method is ever truly perfect.
