Three research teams last week showed practical ways to bypass passkey-based login in Microsoft Entra ID, Google Password Manager in Chrome, and Windows Hello for Business, including Microsoft’s Windows logging issue CVE-2026-34348. The work did not break FIDO2; it reused signed auth material, synced passkey secrets, or a live Windows session to satisfy the login flow instead.
In plain terms, the attacker leans on something the platform already treats as proof — a logged-in browser, stored sync material, or a signed assertion — so the identity provider accepts the sign-in as legitimate. That means phishing-resistant MFA can still fail if malware, session access, or local platform data is already in play.
For shops that rely on cloud-synced passkeys or Windows Hello for Business, the trust boundary is no longer just the authenticator itself; the surrounding device, browser, and tenant plumbing is part of the security model too.