Pass the Passkey

Executive summary: This white paper analyzes three practically exploitable WebAuthn/Passkey vulnerabilities in Windows 11 and Microsoft Entra ID, detailing how WebAuthn assertions can be replayed, forged, or hijacked via local event logs, OS prompts, and attacker-controlled tooling; it presents multiple attack techniques (replay, circuit breaker, phishing, prompt flooding, UI spoofing, and remote-relay), describes open-source tooling (Passkey Injector, SharpPasskeys, DSInternals UI) and OPSEC considerations, and offers mitigations and timelines. It is a threat intelligence research document rather than a report of a single incident.