Comment by autoexec

There are a lot of examples of attacks and bypasses, but this one is probably the worst I've seen so far https://www.techtimes.com/articles/323093/20260805/google-pa...

It's not just the end user that you have to worry about, attacks are helped by the fact that websites suck at passkeys too

"...we developed PASSKEYS-ATTACKER. The tool allows for precise manipulation of WebAuthn messages at every step of the protocol and integrates 15 attack types of which 10 were not covered in previous work. Among them, 2 attack types have critical CVSS scores. We discovered them on 18 out of 103 evaluated websites. These attacks take over user accounts, delete their passkeys, or lock them out of their accounts. Nearly half of the tested sites (53) were vulnerable to at least one attack with a high CVSS score, exposing users to threats such as phishing and session fixation." https://www.usenix.org/conference/usenixsecurity26/presentat...