Damn Vulnerable Passkey (DVP)

Damn Vulnerable Passkey (DVP) is a deliberately insecure WebAuthn/Passkey training platform designed to help security professionals and enthusiasts explore, understand, and exploit various vulnerabilities in modern authentication schemes. By simulating real-world scenarios with misconfigurations, improper server-side checks, and weak client implementations, DVP allows hands-on practice in identifying and mitigating threats that could compromise WebAuthn-based authentication systems.