Beyond the Ceremony - The 2026 Passkey Attack Surface

The talk starts from the premise that the WebAuthn ceremony is cryptographically sound, but that real passkey deployments rarely rely on it alone. Passkeys usually sit beside weaker sign-in methods, and the login depends on many parts: the authenticator, the transport between devices, the browser, the relying party server, cloud sync, and account recovery. The speaker organizes the scattered research into one map of these components and treats each attack as a stop that still works after a correct ceremony.

Along the way, the talk covers management interfaces exposed by the CTAP cross-device protocol, relay attacks on the QR-code hybrid flow, and client-side tricks such as redirecting ceremonies through malicious extensions or XSS. Most of the time is spent on the server side, where tampering with client data, origin, relying party ID, signatures, algorithms and credential IDs can be tested. A cited study found all 103 live relying parties vulnerable to at least one server-side attack. The speaker also shows Passkey Editor, a Burp extension that decodes vendor-specific encodings and applies preset attacks, demonstrated against WebAuthn.io and GitHub.

The closing sections cover cloud sync, where weak account protection can undermine a passkey, and the interpersonal threat of a partner or family member with access to a shared device. The practical takeaway is that server-side checks form a finite checklist to run quickly, leaving time for business-logic testing. The tool is available for testing passkey deployments.