The security threat arises from relying parties failing to validate the User Verified flag in passkey implementations. Passkeys are designed to provide strong passwordless authentication with MFA properties. However, if the User Verified flag is ignored or improperly checked, the authentication process can be bypassed or weakened, reducing MFA to a single factor. This creates a new attack surface that adversaries can exploit to impersonate users or bypass authentication controls. The analysis is based on a detailed report by Palo Alto Unit 42, which explores these implementation gaps and their security implications.

The impact is a reduction in authentication security from multi-factor to effectively single-factor, increasing the risk of unauthorized access. Attackers could exploit this to bypass intended authentication protections, potentially leading to account compromise. No known exploits in the wild have been reported at this time.

No specific patch or official fix is indicated in the provided information. Organizations should ensure that their passkey implementations correctly validate the User Verified flag as part of the authentication process. Vendors and relying parties should review and update their authentication flows to enforce proper validation of all passkey security attributes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.