Unprotected Session Tokens Can Undermine FIDO2 Security

Silverfort's analysis warns that while FIDO2 effectively protects the authentication step, many implementations fail to protect the post-authentication session tokens; an attacker who achieves a man-in-the-middle position (via DNS/DHCP spoofing, ARP poisoning, SLAAC, etc.) can steal unbound session tokens and hijack SSO access. The report found that tested vendors (Yubico, EntraID, Ping) successfully secured authentication but still exposed sessions to token theft, and experts urge enabling token binding and improving session protection to mitigate this risk.