Critical Vulnerabilities Exposed in Belgian eID Software Used by Millions

A flaw chain in Belgium’s national digital identity client software left over two million citizens, major financial institutions, and public portals vulnerable to silent identity theft, document forgery, and arbitrary code execution. Disclosed by researcher James Arnott of Bay Area Labs at DEF CON, the flaws centered on the Connective digital identity system—a browser extension and local agent bridge developed by Nitro Software Belgium. The software is a critical pillar of Belgium’s electronic identity (eID) ecosystem, utilized by 60 government agencies and eight of the country’s ten largest banks to process authentication and execute legally binding electronic signatures.

The underlying flaws allowed any arbitrary website or embedded online advertisement to bypass browser isolation mechanisms, command the local eID software, capture user credentials, and hijack identity sessions without user interaction.

Unvalidated Origins and PIN Interception

The primary security breakdown stemmed from a missing origin check within the Connective local application component. Software systems that bridge web browsers to physical hardware—such as smart card readers—frequently establish local communication channels (such as local WebSocket connections or native messaging interfaces). When these applications fail to validate the Origin header of incoming requests, any origin running inside the user’s browser gains unauthenticated access to the local agent’s API.

In the case of Connective, any malicious site or compromised ad network could interact directly with the client application running on a victim’s workstation. A background web script could silently probe the local agent to pull sensitive electronic ID details and payment card data stored within the connected smart card system.

Beyond passive data harvesting, the flaw enabled active credential theft through dialog manipulation. The Connective software permitted web applications to customize the visual text within local OS-level PIN entry pop-ups without displaying the requesting web domain. Attackers could trigger an authentic-looking authentication prompt asking the user for their physical eID card’s PIN. When entered, the native dialog transmitted the cleartext PIN straight back to the requesting web page.

With the valid PIN captured and the card physically inserted into a smart card reader, an attacker’s script could silently generate qualified electronic signature (QES) tokens. Under eIDAS regulations and local law, these forged tokens carry the same legal weight as a handwritten signature, allowing remote attackers to sign contracts, approve financial transactions, or authorize binding legal actions in the victim’s name.

Remote Code Execution and Worm Potential

A secondary vulnerability discovered in the Connective suite extended full compromise to systems even when a physical eID card was not plugged in. This issue involved improper handling and processing of files located on the local filesystem.

By tricking a target into downloading a file disguised as a standard document and subsequently landing them on a malicious webpage, an attacker could force the Connective software to process the local file improperly, triggering arbitrary code execution under the security context of the logged-in user. Because the attack required no elevated privileges or administrative confirmation, an attacker gaining local execution could harvest persistent session cookies, steal saved browser credentials, or deploy additional payload stages.

Arnott noted that this execution vector carried self-propagating worm potential: an infected machine could automatically use hijacked messaging or email sessions to send malicious web links and payloads to other users on the same network or contact list, cascading access across enterprise environments.

Systemic Impact on Belgian Trust Infrastructure

While individual identity service providers contained no native vulnerabilities, the trust model of Belgium’s national digital infrastructure relied heavily on the validity of eID cryptographic assertions. The ability to silently extract eID data and forge signatures eroded the foundational security assumptions of key identity gateways:

• CSAM.be: The primary access management gateway for Belgian federal and regional public services, including tax portals, health records, and social security systems.
• Itsme: A widely used mobile identity platform whose initial account registration and re-authentication processes frequently rely on eID card signatures.
• Financial Services: Eight major Belgian banks using Connective for high-value transaction approvals and online account management.

An attacker possessing stolen signing capabilities could exploit these gateway trust relationships to register secondary authentication apps, hijack existing account registrations, or establish persistent access across government portals without triggering traditional anomaly detection mechanisms.

Remediation and Vendor Response

Nitro Software Belgium was initially notified of the findings and spent 146 days remediating the flaws before deploying updates. Final security enforcement controls were finalized in late July, incorporating strict domain origin validation for incoming web requests and securing native dialog prompt rendering. The vendor awarded a $200 bug bounty for the report.

Despite the severity and broad deployment of the software, no CVE identifiers were assigned to these vulnerabilities, and Nitro did not respond to public requests for formal comment following the DEF CON presentation.

Organizations and end-users in Belgium utilizing the Connective browser extension and desktop client should verify that their local installations have updated to the post-July build containing the enforced origin validation and secure PIN dialog controls. Enterprise administrators should ensure that browser extensions managed via Group Policy or MDM profiles are forced to the latest release and monitor for unvalidated local agent communications originating from external web contexts.