Critical Flaws in Belgian eID Software Exposed 2 Million Users

Security researcher James Arnott, founder of cybersecurity firm Bay Area Labs, disclosed severe vulnerabilities in the Connective digital identity system, a browser extension developed by Nitro Software Belgium and used by over two million people across eight of Belgium's ten largest banks and more than 60 government agencies. Presented at DEF CON, the findings revealed that the software failed to verify which website was attempting to communicate with the user's local application, allowing any webpage or embedded advertisement to interact directly with the Connective software running on a victim's machine without consent or notification. Because the browser extension serves as the gateway for legally binding electronic signatures and authentication to critical services like CSAM.be and third-party identity providers such as Itsme, the failure undermined the trust model of Belgium's entire digital identity ecosystem.

The attack chain began with a malicious website silently reading connected eID and payment card details from the user's machine. More alarmingly, attackers could craft official-looking authentication pop-ups and customize the dialog text without displaying the originating domain, making phishing prompts indistinguishable from legitimate requests. When a victim entered their eID PIN, the application transmitted it back to the requesting webpage, enabling attackers to generate unauthorized approval tokens and forge legally binding electronic signatures whenever the victim's physical eID card was inserted into a reader. Given that stolen signing capabilities could be used to register or hijack digital identity accounts on government portals, anyone concerned about exposure should run an email breach checker to confirm their credentials have not been compromised, and test their browser's identity surface with a browser fingerprint test.

Arnott also uncovered a remote code execution flaw that operated independently of whether an eID card was present. By exploiting the application's handling of local files, a malicious site could coerce the software into executing attacker-controlled code at the user level through a drive-by attack requiring only that a victim download a file disguised as a standard document and visit a webpage. The vulnerability demanded no special permissions and carried worm-like propagation potential, as it could hijack user credentials to distribute malicious links to additional victims. Nitro fully remediated the issues 146 days after the initial report and awarded a $200 bug bounty, deploying updates to block unauthorized origin requests and secure PIN handling, with final security enforcement completed in late July. Users should verify their browser extensions are updated and strengthen credential hygiene using a password checker to ensure reused or weak passwords do not amplify the impact of similar authentication-layer attacks.