Researchers Identify 39 Vulnerabilities Targeting Passkey Authentication

Security researchers have disclosed a set of 39 distinct techniques that can undermine the authentication process built around passkeys, a credential system promoted as a replacement for traditional passwords.

Passkeys, which rely on public‑key cryptography and are standardized by the FIDO Alliance and the W3C’s WebAuthn specification, store a private key on a user’s device while the corresponding public key is registered with online services. By eliminating the need to remember or transmit secret passwords, passkeys were expected to close many of the attack surfaces that have plagued legacy authentication, such as phishing, credential stuffing and replay attacks.

The new analysis, first reported by BleepingComputer, breaks down the weaknesses into several categories. Attackers can manipulate authentication prompts to trick users into approving rogue transactions, exploit the way credentials are synchronized across devices, intercept or tamper with the enrollment flow that creates a new passkey, and abuse recovery mechanisms that allow a lost or reset passkey to be re‑issued. The researchers also point to “trust boundary” issues, where the implicit trust placed in platform components or third‑party services can be leveraged to extract or reuse secret material.

While the findings do not imply that every passkey implementation is vulnerable, they highlight that the ecosystem’s security depends on more than the cryptographic strength of the keys themselves. Misconfiguration, inadequate user‑interface design, and reliance on cloud‑based syncing services can reintroduce the very vectors that passkeys were meant to eliminate. Enterprises and developers are urged to audit their integration points, enforce strict prompt designs, and limit the scope of credential syncing to trusted devices only.

Industry observers note that the disclosure arrives at a time when major operating‑system vendors and browsers are pushing passkeys to mainstream users. The research underscores the need for continuous hardening, user education, and transparent recovery policies. As the community digests the 39 methods, further updates to the FIDO specifications and best‑practice guidelines are expected, aiming to preserve the promise of password‑free authentication while addressing the newly identified gaps.