Critical Vulnerability Lets Attackers Bypass MFA in Windows 11 and Entra ID

Key Takeaways

• A new “Pass-the-Passkey” attack technique exploits systemic implementation flaws in WebAuthn, undermining passkey security.
• The vulnerabilities affect Windows 11 (CVE-2026-34348) and Microsoft Entra ID, allowing attackers to bypass multi-factor authentication (MFA) and impersonate users.
• The core issue involves Windows 11 logging full WebAuthn assertion responses, which can be replayed against Entra ID due to its insufficient anti-replay validation.
• Microsoft has issued a patch for Windows 11 (CVE-2026-34348) in its July 14, 2026 security release to mitigate the assertion logging vulnerability.

A novel set of attack techniques, dubbed “Pass-the-Passkey,” has emerged, demonstrating how fundamental implementation weaknesses within the WebAuthn standard can compromise passkey security. This vulnerability persists even when the cryptographic private keys themselves remain securely stored within hardware tokens or other trusted enclaves.

Researchers at SpecterOps have uncovered three primary vulnerabilities spanning the WebAuthn ecosystem, leading to over 20 distinct attack methods. These techniques impact a broad range of systems, including Windows 11, Microsoft Entra ID, various web browsers, popular password managers, and critical enterprise authentication workflows.

Pass-the-Passkey Bypass Phishing-Resistant MFA

The principal attack vector identified by SpecterOps originates from how Windows 11 handles WebAuthn assertion responses. During passkey authentication events, Windows 11 was found to log complete, un-truncated assertion responses directly into its Event Logs. These highly sensitive assertions contain cryptographic signatures and authenticator data, which are crucial for verifying identity.

An adversary who gains local or delegated access to a shared or compromised endpoint can harvest these logged assertions. They can then replay these assertions against authentication endpoints that lack robust anti-replay validation mechanisms. This means that if a privileged cloud administrator authenticates from a compromised workstation, an attacker can exfiltrate the logged assertion material. This enables them to impersonate the administrator’s identity without ever needing to steal the private keys associated with the passkey. Maintaining stringent Windows 11 security controls is therefore paramount to prevent the local harvesting of these logs.

In a detailed whitepaper published by SpecterOps, the researchers revealed that Microsoft Entra ID significantly amplified the impact of assertion exfiltration. This was due to Entra ID’s omission of essential WebAuthn anti-replay checks during its server-side validation process.

Specifically, Entra ID’s validation procedures failed to:

• Confirm the uniqueness of challenges or prevent their reuse across multiple requests.
• Directly bind authentication challenges to specific user sessions.
• Accurately track and evaluate increments in authenticator signature counters.

The combination of Windows’ assertion logging and Entra ID’s validation deficiencies created a fertile ground for practical Passkey Replay Attacks. These attacks allowed unauthorized access to privileged Microsoft cloud accounts, effectively bypassing even phishing-resistant Multi-Factor Authentication (MFA) requirements.

Microsoft has since addressed the assertion logging vulnerability, tracked as CVE-2026-34348, in its security release on July 14, 2026. Fully patched Windows 11 systems now truncate signature fields within logged assertions to six bytes. This prevents assertion replay while still preserving sufficient diagnostic data for IT administrators. Applying timely Windows security updates and implementing kernel security hardening measures remain crucial for mitigating local assertion exposure.

Beyond Assertion Replay: API Manipulation and Phishing

Beyond the assertion replay mechanism, the SpecterOps research also unveiled that local malware can weaponize legitimate WebAuthn APIs to stage highly convincing authentication prompts. This can be achieved without the need to extract any private key material. Adversaries can combine WebAuthn API hooking with several techniques:

• Prompt Flooding: Repeatedly triggering credential prompts to induce user fatigue, making them more likely to approve a malicious request.
• Application Identity Spoofing: Altering caller parameters to mimic legitimate enterprise applications, tricking users into interacting with malicious prompts.
• Remote Desktop Pass-Through: Tunneling passkey requests across active Remote Desktop Protocol (RDP) sessions, potentially bridging network boundaries.
• Credential UI Handle Spoofing: Overlapping malicious user interface frames onto authentic Windows Credential UI windows, making it difficult for users to discern the legitimate prompt.

Microsoft reviewed the reported Credential UI window handle spoofing technique and classified it as a low-severity defense-in-depth issue.

To aid defenders in assessing and securing their environments, SpecterOps has released open-source utilities. These tools facilitate assertion injection, event-log mining, and WebAuthn API hooking, allowing organizations to proactively test their defenses.

What You Should Do

SpecterOps underscores that passkeys fundamentally offer superior security compared to traditional password-based authentication, particularly when device-bound hardware tokens are enforced. To mitigate the risks associated with passkey replay and UI spoofing, organizations should implement the following controls:

• Keep OS Endpoints Updated: Ensure all Windows 11 endpoints are patched with updates released after July 2026 to enforce signature truncation as per CVE-2026-34348.
• Enforce Server-Side Replay Protections: Configure Relying Party (RP) servers to bind challenges to active user sessions and rigorously track authenticator signature counters.
• Monitor Local WebAuthn Execution: Actively audit process telemetry for any untrusted or unapproved applications attempting to invoke WebAuthn APIs.
• Enforce Attestation Policies: For high-privilege administrative accounts within Entra ID, require hardware-backed passkey attestation to enhance security.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.