Start with Identity
Subscribe
Identity CVE · FIDO2 / WebAuthn

CVE-2026-34348Windows stores WebAuthn assertions in cleartext event logs

high
Product: Windows Event Logging ServiceVendor: MicrosoftDisclosed: 2026-07-14Status: PatchedProtocol deep diveNVD ↗

What broke

Windows Event Logging wrote WebAuthn assertion material in cleartext. An unprivileged local user, and in some configurations a remote reader of forwarded logs, could recover it. SpecterOps and Roman Grafnetter showed at Black Hat USA 2026 that the recovered assertion can be replayed against Entra ID ("Pass-the-Passkey"). Microsoft patched in July 2026.

Why it matters

Passkeys are supposed to be the phishing-resistant endgame. They fail if the platform logs the assertion the way it used to log passwords. This CVE does not break WebAuthn cryptography. It breaks the operating system's handling of the ceremony. Combine it with FIDO downgrade techniques (PoisonSeed / Proofpoint, no CVE) and you have the 2026 passkey lesson: the protocol can be fine and the surrounding telemetry still gives the attacker a replay.

What to do

  • Patch Windows for July 2026 on workstations and on any collector that stores forwarded Security / Operational logs.
  • Treat WebAuthn debug logging as secret. Do not ship raw assertion bytes to a SIEM without redaction.
  • Bind WebAuthn challenges to the session the way GitHub does, so a stolen assertion is useless elsewhere.
  • Read the WebAuthn / FIDO2 deep dive and the passkey glossary entry before you brief this as "passkeys are broken." They are not. Logging is.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.