ES2605-2daaff2c - Failure to Revoke Previously Registered Passkeys During Account Recovery

[cmullaly-mitre]

Submission File: ES2605-2daaff2c-new-failure-to-revoke-previously-registered-passkeys-during-account-recovery.txt

ID: ES2605-2daaff2c

SUBMISSION DATE: 2026-05-24 17:25:18

NAME: Failure to Revoke Previously Registered Passkeys During Account Recovery

DESCRIPTION:

Modern applications increasingly support passwordless authentication using
passkeys based on WebAuthn/FIDO2. Passkeys are intentionally designed to
operate independently from passwords using asymmetric cryptography, where:

• the private key remains on the user's device,
• the public key is stored server-side,
• and authentication occurs through cryptographic challenge signing rather
  than password verification.

Because of this architecture, password resets do not automatically
invalidate previously enrolled passkeys. This behavior is commonly
considered