Passkeys / WebAuthn: Attacks & Pitfalls

Passkeys (WebAuthn/FIDO2) bind a credential to the origin, making them phishing-resistant — the strongest widely deployed authenticator. The attacks that remain target everything around the passkey.

Where the risk moves

• Recovery fallback: if "lost your passkey?" drops to SMS OTP or email links, the account is only as strong as that fallback. Attackers skip the passkey and phish the weaker path.
• Relying Party misconfig: an overly broad or wrong rpId, missing user-verification requirement, or accepting cross-origin assertions weakens the binding.
• Mixed factor downgrade: offering password+passkey lets attackers force the password path.
• Device/sync trust: synced passkeys inherit the security of the cloud account that syncs them.

How to test

Map every authentication and recovery path. Attempt to complete login or recovery without the passkey. Check rpId/origin validation and whether user verification is enforced.

Impact

Account takeover via the weakest alternative path, even though the passkey itself is sound.

Defenses

• Make recovery as strong as the primary factor; avoid SMS fallback.
• Enforce user verification and correct rpId/origin; don't offer weaker downgrades for sensitive accounts.