A newly identified vulnerability in passwordless authentication occurs when relying parties fail to properly validate the User Verified flag during login. This implementation gap effectively reduces multi-factor authentication to a single factor, significantly undermining the core security benefits of passkey systems.