Craft CMS passkey login functionality improperly handles WebAuthn assertions by accepting replayed requestOptions and failing to update the stored credential counter. This allows an attacker who captures a successful passkey login request body to replay it and create additional authenticated sessions for the victim user, effectively bypassing WebAuthn's replay protections and enabling account/session takeover.