Pass the Passkey: SRE Lessons from the New Frontier of Passwordless Authentication Vulnerabilities

Unit 42 recently published a critical analysis of passwordless authentication, titled 'Pass the Passkey: A Novel Attack Surface in Passwordless Authentication.' While FIDO2 and WebAuthn have drastically improved security compared to traditional credentials, researchers have identified new methods to compromise these workflows.

The Vulnerability: Exploiting Relying Party IDs

The core of the attack lies in how Relying Party IDs (RP IDs) are scoped. If an organization has misconfigured subdomains, outdated DNS entries, or orphan domains, attackers can perform subdomain takeovers or hijack DNS records. Since WebAuthn relies heavily on the browser's origin matching rules, control over a subdomain can allow an attacker to bypass domain-binding restrictions and intercept or register unauthorized passkeys.

Why SREs and DevOps Teams Must Act

Infrastructure security is no longer distinct from application-level authentication. To prevent 'Pass the Passkey' style attacks, SREs must maintain absolute control and visibility over their domain surface area:

1. Prevent Orphan Subdomains: Unused cloud resources pointing to inactive DNS records are ripe for exploitation.
2. Enforce Strong TLS Boundaries: Valid, modern SSL/TLS configurations are mandatory for secure context validation.
3. Monitor Vendor Identity Providers: If third-party authentication services experience issues or changes, real-time alerts are crucial.

Securing Your Infrastructure with Rabbit SaaS

At Rabbit SaaS, we provide the precise monitoring tools required to secure your relying party infrastructure against these vectors:

• Domain Audit HQ: Actively monitors your domain names, DNS configurations, and WHOIS records. By alerting you to DNS changes or expiring subdomains, we help eliminate the orphan zones that attackers target to mount WebAuthn hijacking attempts.
• Certificate Guardian: Ensures that every single subdomain hosting your authentication endpoints is backed by active, valid, and correctly configured SSL/TLS certificates, preventing security downgrades.
• CloudStatusHQ: Tracks the real-time operational health of your third-party identity and access management providers (like Okta, Auth0, or Azure AD) so you can detect anomalous authentication platform behavior instantly.