Enterprise Passkey Security: Beyond FIDO2 Cryptography

The Hardening Reality of Enterprise Passkey Security

Passkeys have rapidly emerged as a cornerstone of modern, phishing-resistant authentication, promising a future free from passwords. Built on the robust FIDO2 standard and public-key cryptography, their inherent resistance to credential theft has been a significant step forward for enterprise security. However, recent research indicates that while the cryptographic core of FIDO2 remains unassailable, the surrounding ecosystem presents a growing attack surface that enterprises can no longer ignore. The narrative has shifted: passkey security is no longer solely about cryptographic strength, but about the integrity of its implementation and the broader authentication infrastructure.

The Passkey Paradox: Strong Crypto, Vulnerable Ecosystem

The initial promise of passkeys was simple yet revolutionary: replace passwords with cryptographically strong, phishing-resistant credentials. This promise holds true at the protocol level; FIDO2 is designed to prevent credential reuse and direct phishing of the private key. Yet, the real-world deployment of passkeys introduces complexities that extend beyond the core FIDO2 specification. Attackers are now targeting the "everything built around it" – the very infrastructure enabling passkey management and use.

Multiple independent research efforts have converged on this critical distinction. Researchers from SpecterOps, for example, have identified 39 distinct methods to compromise passkey authentication systems, none of which involve breaking the underlying FIDO2 cryptography. Instead, these methods exploit vulnerabilities in the ecosystem surrounding passkeys, including enrollment workflows, device management, recovery mechanisms, and the operating systems that host passkey implementations [9]. This exposes a crucial paradox: strong cryptography does not automatically equate to unassailable security when implementation flaws or ecosystem weaknesses are present.

Emergent Attack Vectors: Beyond Phishing Resistance

Enterprise security teams must now expand their threat models for passkeys beyond traditional phishing. Key attack vectors emerging from recent research include:

• Credential Enrollment Bypass (CVE-2026-19117): A critical vulnerability impacting on-premises FIDO2 deployments (CVSS 9.8) allows an attacker to register their own FIDO2 credential against a target user’s account under specific conditions, leading to full account takeover [8]. This bypasses the legitimate user's intended credential, highlighting flaws in the enrollment process itself.
• "Pass-the-Passkey" Techniques: Akin to "Pass-the-Hash" attacks, these methods focus on exploiting weaknesses in the authentication flow after the FIDO2 ceremony is complete. Researchers have demonstrated techniques that produce a privileged sign-in without extracting the private key from a hardware module. This includes exploiting information disclosure flaws (e.g., CVE-2026-34348 in Windows Event Logging Service) where signatures or authentication artifacts might be retained and replayed [7].
• Device and OS-Level Vulnerabilities: Since passkeys are often tied to devices or managed by operating systems (e.g., Windows Hello, Google Password Manager), vulnerabilities in these host environments can expose passkey-protected accounts. Malware can manipulate the authentication process or exploit sync mechanisms, even if the FIDO2 protocol itself remains secure [9].
• Self-Service Password Reset (SSPR) Exploits: Microsoft's recent enforcement around SSPR in Entra ID, terminating the use of unregistered contact data, underscores the importance of securing recovery mechanisms. While intended to strengthen identity, poorly configured or unmanaged SSPR flows can still be an avenue for attackers to regain access, especially if passkeys are not yet universally adopted or properly governed [10].

These attack vectors reveal that the threat is no longer about tricking a user into giving up a password; it