Critical Vulnerabilities in Belgium’s Connective Signing Extension Exposed Millions to Fraud and RCE
Security researchers uncovered severe flaws in the Connective Signing Extension, a browser component used by over 2 million people in Belgium for accessing electronic identity (eID) cards and Maestro payment cards. The now-patched vulnerabilities could have enabled attackers to steal eID PINs, harvest card data, forge signing requests, and execute malicious code on Windows devices all with minimal user interaction.
How the Flaws Worked
The extension acts as a bridge between websites, a browser plugin, and a native application that communicates with smart-card readers. However, researchers from Have I Been Pwned identified multiple critical weaknesses:
-
Token Replay Attacks – The extension failed to properly validate the origin of requests, allowing malicious websites to replay tokens issued to legitimate services. This could let attackers interact with the native host and extract data from connected eID or Maestro cards without the user’s knowledge.
-
PIN Phishing via Fake Dialogs – Attackers could display native-looking PIN prompts with custom titles and messages, impersonating trusted banking or government services. The stolen PIN, combined with access to an eID card, could enable unauthorized authentication or document signing.
-
Drive-By Remote Code Execution (RCE) – A command in the native host could load a library from an attacker-controlled path. By tricking users into downloading a malicious file, attackers could execute arbitrary code at the current user’s privilege level, even without an eID card connected.
Broader Impact
Belgium’s eID system is integral to banking, public services, and legally binding electronic signatures under the EU’s eIDAS regulation. A compromised signing capability could facilitate account takeovers, fraudulent identity verification, or large-scale identity theft. Researchers demonstrated an account takeover involving Belgium’s CSAM (Child Abuse Material) reporting system, though impacts on other platforms depended on additional security controls.
Remediation Timeline
Nitro Software Belgium, the company behind Connective and an EU-listed Qualified Trust Service Provider, deployed fixes in stages:
- Disabled the risky library-loading feature.
- Modified PIN-token handling to prevent decryption by malicious sites.
- Enforced origin checks for all requests.
The final patch was released 146 days after the initial report, though no CVEs were assigned at the time of disclosure. The vulnerabilities highlight the risks of third-party identity and payment integrations, particularly in high-trust environments like government and financial services.
Source: https://cybersecuritynews.com/connective-eid-extension-flaws/
Connective - a Nitro company cybersecurity rating report: https://www.rankiteo.com/company/connective
"id": "CON1786357491",
"linkid": "connective",
"type": "Vulnerability",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Over 2 million users',
'industry': ['Government Services',
'Financial Services',
'Identity Verification'],
'location': 'Belgium',
'name': 'Nitro Software Belgium (Connective)',
'type': 'Qualified Trust Service Provider'}],
'attack_vector': ['Malicious Website', 'Token Replay Attack', 'Fake Dialogs'],
'data_breach': {'personally_identifiable_information': 'Yes (eID data, '
'payment card details)',
'sensitivity_of_data': 'High (PII, payment information, '
'legally binding signatures)',
'type_of_data_compromised': ['eID PINs',
'Maestro payment card data',
'Electronic signatures']},
'description': 'Security researchers uncovered severe flaws in the Connective '
'Signing Extension, a browser component used by over 2 million '
'people in Belgium for accessing electronic identity (eID) '
'cards and Maestro payment cards. The now-patched '
'vulnerabilities could have enabled attackers to steal eID '
'PINs, harvest card data, forge signing requests, and execute '
'malicious code on Windows devices with minimal user '
'interaction.',
'impact': {'brand_reputation_impact': 'High (trust in eID and payment '
'systems)',
'data_compromised': ['eID PINs',
'Maestro payment card data',
'Electronic signatures'],
'identity_theft_risk': 'High',
'legal_liabilities': ['Potential violations of EU eIDAS '
'regulation'],
'operational_impact': ['Unauthorized authentication',
'Fraudulent document signing'],
'payment_information_risk': 'High',
'systems_affected': ['Windows devices with Connective Signing '
'Extension']},
'investigation_status': 'Patched',
'lessons_learned': 'Risks of third-party identity and payment integrations in '
'high-trust environments like government and financial '
'services.',
'motivation': ['Fraud', 'Identity Theft', 'Unauthorized Access'],
'post_incident_analysis': {'corrective_actions': ['Disabled library-loading '
'feature',
'Modified PIN-token '
'handling',
'Enforced origin checks'],
'root_causes': ['Improper origin validation in the '
'Connective Signing Extension',
'Unsafe library-loading '
'functionality',
'Lack of secure PIN-token '
'handling']},
'recommendations': ['Enforce strict origin validation for browser extensions',
'Implement secure PIN-token handling to prevent phishing',
'Disable unsafe library-loading features',
'Enhance monitoring for token replay attacks'],
'references': [{'source': 'Have I Been Pwned'}],
'regulatory_compliance': {'regulations_violated': ['EU eIDAS regulation']},
'response': {'containment_measures': ['Disabled risky library-loading feature',
'Modified PIN-token handling to prevent '
'decryption by malicious sites',
'Enforced origin checks for all '
'requests'],
'remediation_measures': 'Patches deployed in stages over 146 '
'days',
'third_party_assistance': 'Security researchers from Have I Been '
'Pwned'},
'title': 'Critical Vulnerabilities in Belgium’s Connective Signing Extension '
'Exposed Millions to Fraud and RCE',
'type': ['Data Breach', 'Remote Code Execution (RCE)', 'Phishing'],
'vulnerability_exploited': ['Improper origin validation',
'Token replay vulnerability',
'Unsafe library loading',
'PIN phishing via fake dialogs']}