vulns.co
/
GKData.io MCP

Back to Gadgets

Passkey recovery skips WebAuthn

Inventory every path that gets a user back in without a WebAuthn assertion: email or SMS recovery, backup codes, support overrides, and passkey registration on a session that never completed the ceremony. The authenticator is not the control if a weaker path…

Tags: passkey, webauthn, ato, email

Typical severity: P2-P4

What it becomes

Low alone, and it becomes account takeover when a recovery path issues a full session even though primary login requires a passkey.

Where to look

  • account recovery
  • backup codes and lost-device flows
  • passkey registration on an existing session

Chains

  • Account takeover: Primary login requires a passkey, but recovery still issues a full session for an account you own.
  • Durable access: A session that never completed WebAuthn is allowed to register a new passkey, so the strong factor is added by whoever holds the weak session.

Notes

  • Use authenticators and mailboxes you own. Do not bind a passkey to someone else's account.
  • A documented backup factor is not a bug. The bug is a backup factor the product treats as weaker than the passkey and then forgets to step up.