VulnerabilityPublished 10 Aug 2026

Critical Flaws Discovered in Belgian eID Software Used by 2 Million People

Source SecurityWeek

Severity

Critical

Rated Critical by SecurityWeek

Data as of 10 Aug 2026, 21:20 UTC

What to do

AI-suggested

Nitro Software Belgium has fully remediated the vulnerabilities and deployed security updates that block unauthorized origin requests and secure PIN handling. The final security enforcement was completed in late July 2026, 146 days after the initial report. Users and organizations should ensure they have applied the latest updates from Nitro Software Belgium. Since the vendor has addressed the issues with an official fix, no additional immediate mitigation steps are required beyond updating to the patched version.

Description

The vulnerabilities affected software used by eight of Belgium’s ten largest banks and over 60 government agencies. The post Critical Flaws Discovered in Belgian eID Software Used by 2 Million People appeared first on SecurityWeek .

Impact

The vulnerabilities compromised the trust model of Belgium's digital identity ecosystem, affecting major banks and government agencies. Attackers could steal sensitive eID and payment card information, perform phishing attacks to capture PINs, and forge legally binding electronic signatures. The remote code execution flaw allowed attackers to execute arbitrary code on users' machines without elevated privileges, potentially enabling further compromise and self-propagating attacks. These issues risked identity theft, unauthorized transactions, and account hijacking across government portals and third-party identity providers relying on eID signatures.

Summary

The Connective digital identity system, a browser extension developed by Nitro Software Belgium and widely used for digital identity authentication and electronic signatures, contained critical vulnerabilities. The software failed to verify the origin of website requests, enabling any website or embedded ad to communicate with the application without user permission. This flaw allowed silent reading of eID and payment card data and phishing attacks via customizable authentication pop-ups lacking domain information, leading to PIN theft. Stolen PINs could be used to generate unauthorized approval tokens to forge electronic signatures when the victim's eID card was inserted. Furthermore, a remote code execution vulnerability existed in the file processing logic, allowing attacker-controlled code execution at the user level without special permissions or requiring an eID card. Nitro Software Belgium addressed these vulnerabilities with updates blocking unauthorized origin requests and securing PIN handling, completing remediation in late July 2026, 146 days after initial reporting. No CVEs have been assigned.

References

securityweek.com/critical-flaws-discovered-in-belgian-eid-software-used-by-2-million-people/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 10 Aug 2026, 04:56 UTC

References

Community reviews