Passkey and WebAuthn
Passkeys are only as strong as the path that skips them. Inventory recovery, backup factors, and credential registration that issue a session without a WebAuthn assertion.
Skill: Session, cookies, and passkeys
Ask: Which cookie or token does the server trust, and can recovery issue a session the primary login would not?
Stop: You can name the cookie or token, the recovery path, and whether a second browser still holds a session after logout.
Checklists
- Passkeys and WebAuthn - A passkey is only as strong as registration, recovery, and the session it mints. Map the ceremony before you treat passwordless as finished.
Disclosures
- A WebAuthn record could be updated from the public key - Insecure direct object reference
Playbooks
- Passkeys and WebAuthn - A passkey is an origin-bound credential. The finding is usually the path around it: recovery, a second factor that still mints a full session, or a registration that attaches a credential to the wrong account.
Tools
- Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.
Questions
Is a weaker recovery path a finding by itself?
Not if the program documents email, SMS, or backup codes as an accepted equivalent. It becomes account takeover when primary login requires a passkey and recovery still issues a full session for an account you own.
What should I record on the WebAuthn ceremony?
Whether the server checks the user-verification flag, the relying party id, and the sign count, and whether a new passkey can be registered from a session that never passed WebAuthn. Use authenticators you own.
This page is the linked pack hunt_brief("passkey") returns on the MCP connector. Authorized testing only.