Researchers document 39 methods to compromise passkey authentication

Security researchers have catalogued 39 distinct techniques for bypassing passkey-based authentication, targeting trust boundaries such as prompts, synced credentials, enrollment, and recovery rather than FIDO2 cryptography itself. The findings highlight that passkeys, while mitigating password attacks, introduce new attack surfaces in their implementation and surrounding workflows. This matters as passkey adoption grows across enterprises and consumer platforms, potentially shifting attacker focus to these documented weaknesses.