CVE-2026-34348Windows stores WebAuthn assertions in cleartext event logs
What broke
Windows Event Logging wrote WebAuthn assertion material in cleartext. An unprivileged local user, and in some configurations a remote reader of forwarded logs, could recover it. SpecterOps and Roman Grafnetter showed at Black Hat USA 2026 that the recovered assertion can be replayed against Entra ID ("Pass-the-Passkey"). Microsoft patched in July 2026.
Why it matters
Passkeys are supposed to be the phishing-resistant endgame. They fail if the platform logs the assertion the way it used to log passwords. This CVE does not break WebAuthn cryptography. It breaks the operating system's handling of the ceremony. Combine it with FIDO downgrade techniques (PoisonSeed / Proofpoint, no CVE) and you have the 2026 passkey lesson: the protocol can be fine and the surrounding telemetry still gives the attacker a replay.
What to do
- Patch Windows for July 2026 on workstations and on any collector that stores forwarded Security / Operational logs.
- Treat WebAuthn debug logging as secret. Do not ship raw assertion bytes to a SIEM without redaction.
- Bind WebAuthn challenges to the session the way GitHub does, so a stolen assertion is useless elsewhere.
- Read the WebAuthn / FIDO2 deep dive and the passkey glossary entry before you brief this as "passkeys are broken." They are not. Logging is.
After you patch
Flaws in the phishing-resistant layer are serious precisely because the resulting authentication satisfies your strongest policy.
- Hunt for authentications with an empty device ID or with no matching interactive session on the originating host, accepting that some legitimate traffic looks similar.
- Review registered authenticators and devices for enrolments you did not expect, which is the persistence step in this class.
- Re-enrol credentials for privileged accounts if assertion material may have been exposed, and prefer device-bound hardware authenticators for those users.
- Verify server-side user verification checks, since accepting an assertion with the flag unset removes the property you deployed passkeys for. See WebAuthn and FIDO2.
Sources
- NVD: CVE-2026-34348
- SpecterOps / Grafnetter, Black Hat USA 2026, Pass-the-Passkey
Related identity CVEs
Related on Start with Identity
- GlossaryFIDO2
FIDO2 is a set of specifications from the FIDO Alliance plus W3C. It combines WebAuthn (the browser API) with CTAP (the client-to-authenticator protocol) to ena
- GlossaryPasswordless
Authentication without a password as a primary factor. Implementations include magic links, OTP codes, and passkeys. Passkeys are the only passwordless method t
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- GlossaryMFA
Multi-Factor Authentication. Requiring two or more factors from distinct categories: something you know (password), something you have (token), something you ar
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
Technique
This CVE is an instance of Token replay against an unbound endpoint. A token that is not bound to the client, session, or challenge that requested it can be lifted once and replayed anywhere the check for binding is missing, no matter how it was strengthened.