Compass Security Shows Passkey Ceremonies Can Be Hooked
Compass Security published a note with two JavaScript hooks that can inspect and alter Web Authentication API (WebAuthn) passkey flows in the browser. The code was built while pentesting a passkey login and was shown working beyond the demo site, not just in one toy setup.
The point is that the page itself starts the ceremony, so JavaScript can watch the options being sent and change them before the browser hands anything to the authenticator. That means the client-side prompt is not the enforcement boundary; the server’s check of what came back is.
For any site that uses passkeys in the browser, this pushes trust back to server-side validation of user verification and authenticator policy. If an application treats the browser’s request as authoritative, the configuration it thinks it asked for may not be the configuration that was actually enforced.