Peer impersonation via reflected pairing public key

Authentication bypass in Microsoft Windows Bluetooth allows physically proximate attackers to impersonate an encrypted pairing peer. During Passkey authentication, the implementation accepts a remote public key whose X coordinate matches the locally generated key, enabling crafted response reflections to reveal the random passkey bit by bit. The attacker must be within wireless range of two vulnerable devices as they initiate BR/EDR or LE pairing with Passkey entry; exploitation authenticates the responder to the attacker, not a transparent connection to both devices.