39 New Methods Discovered That Compromise Passkey Authentication Systems

Researchers have documented 39 methods that can compromise passkey authentication systems. While passkeys eliminate many password-based attacks, the research from Token demonstrates how attackers can exploit authentication prompts, synced credentials, enrollment processes, recovery mechanisms, and other trust boundaries. These attack methods do not involve breaking FIDO2 cryptography itself, but rather abuse other aspects of passkey-based authentication systems.