FIDO2 and WebAuthn identity CVEs
Passkeys fail when the platform logs the assertion, confuses credential types, or lets a ceremony be replayed. The cryptography can be fine. The surrounding implementation is not.
How this protocol fails
Pass-the-Passkey (CVE-2026-34348) stored WebAuthn assertions in cleartext Windows event logs and replayed them against Entra ID. StrongKey confused discoverable and non-discoverable credentials. Keycloak documented a fmt:none attestation-policy bypass. PoisonSeed-style downgrades (no CVE) still talk users off FIDO onto a weaker factor. Phishing-resistant MFA is only as strong as the ceremony and the telemetry around it.
What security people should do
- Patch Windows for the July 2026 logging fix. Treat WebAuthn debug logs as secret. Do not ship raw assertion bytes to a SIEM.
- Bind WebAuthn challenges to the session. A stolen assertion should be useless elsewhere.
- Remove weaker fallback factors. A passkey plus a phishable OTP is the OTP.
- Confirm on-prem FIDO servers distinguish resident keys from server-side credentials.
CVEs in this category
Showing 2 of 2
- CVE-2026-34348highWindows stores WebAuthn assertions in cleartext event logsWindows Event Logging Service · Microsoft · 2026-07-14 · Patched
The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black Hat USA 2026 as Pass-the-Passkey against Entra ID. Patched July 2026.
- CVE-2025-26788highStrongKey FIDO Server credential-type confusion, passkey bypassStrongKey FIDO Server · StrongKey · 2025-02-18 · Patched
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High. Patched by StrongKey.