Pass-the-Passkey Attacks Expose Windows 11 and Microsoft Entra ID, Bypassing MFA

SpecterOps disclosed a "Pass-the-Passkey" family of attacks that exploit systemic WebAuthn implementation flaws—particularly Windows 11 logging of full WebAuthn assertions (CVE-2026-34348) and missing anti-replay validation in Microsoft Entra ID—enabling attackers with local or delegated access to harvest and replay assertions to bypass phishing-resistant MFA and impersonate privileged cloud accounts. The research details over 20 techniques (including API hooking, prompt flooding, UI-handle spoofing), supplies PoC utilities for assertion injection and log mining, and recommends patches, server-side replay protections, telemetry monitoring, and hardware-backed attestation.