CuraSec

Plan archived

Passkey UV Flag Bypass Reduces Passwordless Auth to Single Factor

2026-08-03 13:48 UTC · Unit 42 · read the source ↗ #passkeys#authentication#webauthn
  • Engineer — Plan: Audit your WebAuthn/passkey relying party implementation to confirm the User Verified flag is enforced; if your app accepts assertions without UV=true, you’ve silently degraded MFA to single-factor auth.
  • SOC/IR — Learn: No exploitation in the wild reported and no IOCs available; useful for understanding how passkey bypass could appear in authentication logs if UV flag checks are absent.
  • Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.