Passkey recovery skips WebAuthn
Inventory every path that gets a user back in without a WebAuthn assertion: email or SMS recovery, backup codes, support overrides, and passkey registration on a session that never completed the ceremony. The authenticator is not the control if a weaker path…
Tags: passkey, webauthn, ato, email
Typical severity: P2-P4
What it becomes
Low alone, and it becomes account takeover when a recovery path issues a full session even though primary login requires a passkey.
Where to look
account recoverybackup codes and lost-device flowspasskey registration on an existing session
Chains
- Account takeover: Primary login requires a passkey, but recovery still issues a full session for an account you own.
- Durable access: A session that never completed WebAuthn is allowed to register a new passkey, so the strong factor is added by whoever holds the weak session.
Notes
- Use authenticators and mailboxes you own. Do not bind a passkey to someone else's account.
- A documented backup factor is not a bug. The bug is a backup factor the product treats as weaker than the passkey and then forgets to step up.