CVE-2026-34348 — an information-disclosure flaw in the Windows Event Logging Service — figured centrally in a Black Hat USA 2026 demonstration that showed passkey protections can be defeated without breaking FIDO2 cryptography.
SpecterOps: replaying YubiKey signatures through Windows and Entra ID
SpecterOps principal security researcher Michael Grafnetter presented the firm's "Pass-the-Passkey" research at Black Hat USA on August 5. SpecterOps reported that Windows kept past YubiKey signatures in cleartext where authenticated unprivileged users, including remote users, could read them. That storage is tracked as CVE-2026-34348 and affects releases across Windows 10, Windows 11 and Windows Server, according to the public advisory.
In SpecterOps' chain, the attacker did not extract an authenticator's private key. Instead the dangerous material was an already-generated signature that Windows retained and that the researchers say Microsoft Entra ID accepted when the signatures were replayed. SpecterOps demonstrated that chaining the exposed signatures with Entra ID validation behavior could allow privileged-user impersonation while satisfying policies that require phishing-resistant multifactor authentication (MFA).
Microsoft has published a security update addressing CVE-2026-34348 and told The Hacker News it has "applied mitigations for the reported issue involving passkey relay assertions" while recommending least-privilege access, phishing-resistant authentication methods, and Zero Trust endpoint protections. The company’s published advisory covers the Windows Event Logging Service issue; Microsoft did not provide technical details about the scope of the separate Entra-side mitigations in its response to The Hacker News.
Unit 42: synced-passkey master key and Chrome process exposure
Palo Alto Networks Unit 42's "Pass-ta-key" research examined Google Password Manager's synced-passkey system in Chrome on Windows. All of Unit 42’s described attack paths begin with malware already running on the victim's endpoint and do not require administrator-level privilege escalation.
One path abused Chrome's device identity machinery to obtain signatures that let code act like a legitimate Google Password Manager client without a new device unlock or user interaction; Unit 42 demonstrated that technique against eBay, after which eBay changed its validation of the WebAuthn user-verification flag following the report. The most damaging variant, called "Golden Pass-ta-key," targets the Security Domain Secret, a 32‑byte master key Google uses to protect synced passkeys.
Unit 42 reported finding the Security Domain Secret in Chrome's device logging output; Google removed that logging output after the report. Unit 42 also says the secret is still temporarily present in Chrome's process memory during re-registration, and that with the secret an attacker can recover a victim's synced passkey private keys. The researchers further report that Google's current implementation provides no way to rotate or revoke the Security Domain Secret, which would make such a compromise persistent beyond a single captured login.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDirk‑jan Mollema: using Windows Hello for Business keys without a fresh PIN
Independent researcher Dirk‑jan Mollema showed a separate route centered on Windows Hello for Business. On modern Windows devices the backing key is hardware-protected by the Trusted Platform Module and cannot simply be exported; Mollema found that a low‑privilege process inside an already compromised user session can call Windows cryptographic interfaces to use that non‑exportable key without producing a new PIN or biometric prompt.
Mollema used the Windows Hello key as a FIDO2 credential against Microsoft Entra ID. He found that an Entra WebAuthn challenge is valid for five minutes and is not bound to a session, user or tenant, meaning a challenge requested on an attacker's system can be taken to the victim's machine, signed there, and returned as a WebAuthn assertion. The resulting sign-in can satisfy Conditional Access rules requiring phishing‑resistant authentication. Mollema also observed that the resulting token can lack a device ID claim, creating a path through device registration to a Primary Refresh Token and additional persistence.
Where the fixes differ — and what defenders should do now
- Install Microsoft’s security update for CVE-2026-34348 to address the Windows Event Logging Service disclosure.
- Services accepting WebAuthn assertions should enforce the user-verification requirements they request; eBay changed its handling after Unit 42's report.
- Endpoint defenses need to treat passkey stores, recovery flows and browser memory as credential-sensitive territory; Unit 42's findings highlight the risks of process-memory exposure and re-registration flows.
- Entra defenders can monitor for Windows Hello for Business authentications that lack a device identifier and for unexpected device registrations, which Mollema identified as indicators tied to his flow.
- Note that Microsoft continues to describe passkeys as resistant to replay attacks in Entra migration guidance updated August 3, 2026; the three research tracks show implementation and endpoint compromise can still leave reusable assertions, synced private keys, or a way to generate fresh authentication.
What this means for technologists, enterprise defenders, and end users
Technologists and security teams: patch Windows for CVE-2026-34348 and treat browser process memory and passkey recovery flows as high‑sensitivity assets to monitor and protect, per Unit 42's and SpecterOps' findings.
Enterprise Entra and identity defenders: watch for authentication tokens missing device IDs and for unexpected device registrations tied to Windows Hello for Business; apply Microsoft’s suggested mitigations and least‑privilege access practices described in the company’s statement to The Hacker News.
End users and device owners: understand that none of these reports "cracked" the underlying FIDO2 cryptography — the attacks rely on implementation details or malware already on endpoints — which makes endpoint hygiene and prompt application of vendor updates central to protection.
These three research tracks converge on a single practical lesson: strong public-key math alone cannot prevent vulnerabilities that arise from how systems store, expose, and validate signed assertions or master secrets. Microsoft has released a patch and applied mitigations; Google removed a secret from logging output; eBay adjusted WebAuthn checks. The remaining open questions concern whether the Entra behaviors SpecterOps and Mollema exploited share a single root cause or represent separate validation gaps — the public material does not establish that they are the same issue, even if the outcomes can look similar.
