Stealing cookies: Researchers describe how to bypass modern authentication

Research highlighted by Silverfort shows that attackers can bypass passwordless FIDO2-protected logins by intercepting and reusing SSO session tokens via man-in-the-middle techniques, enabling session hijacking despite strong initial authentication. While not a flaw in FIDO2 itself, the weakness lies in post-authentication session management; mitigations like token binding or Google’s Device Bound Session Credentials can bind tokens to specific TLS sessions or devices, but adoption remains limited and attacks require conditions such as malicious browser extensions or compromised public Wi‑Fi.