The Connective digital identity system, a browser extension developed by Nitro Software Belgium and widely used for digital identity authentication and electronic signatures, contained critical vulnerabilities. The software failed to verify the origin of website requests, enabling any website or embedded ad to communicate with the application without user permission. This flaw allowed silent reading of eID and payment card data and phishing attacks via customizable authentication pop-ups lacking domain information, leading to PIN theft. Stolen PINs could be used to generate unauthorized approval tokens to forge electronic signatures when the victim's eID card was inserted. Furthermore, a remote code execution vulnerability existed in the file processing logic, allowing attacker-controlled code execution at the user level without special permissions or requiring an eID card. Nitro Software Belgium addressed these vulnerabilities with updates blocking unauthorized origin requests and securing PIN handling, completing remediation in late July 2026, 146 days after initial reporting. No CVEs have been assigned.

The vulnerabilities compromised the trust model of Belgium's digital identity ecosystem, affecting major banks and government agencies. Attackers could steal sensitive eID and payment card information, perform phishing attacks to capture PINs, and forge legally binding electronic signatures. The remote code execution flaw allowed attackers to execute arbitrary code on users' machines without elevated privileges, potentially enabling further compromise and self-propagating attacks. These issues risked identity theft, unauthorized transactions, and account hijacking across government portals and third-party identity providers relying on eID signatures.

Nitro Software Belgium has fully remediated the vulnerabilities and deployed security updates that block unauthorized origin requests and secure PIN handling. The final security enforcement was completed in late July 2026, 146 days after the initial report. Users and organizations should ensure they have applied the latest updates from Nitro Software Belgium. Since the vendor has addressed the issues with an official fix, no additional immediate mitigation steps are required beyond updating to the patched version.