--- title: Belgium's eID Authentication Opens Citizen Accounts to RCE description: A DEF CON 34 presentation revealed severe vulnerabilities in Belgium's Connective browser extension, which underpins the country's national eID authentication... canonical: https://daily.dev/posts/belgium-s-eid-authentication-opens-citizen-accounts-to-rce-ab5rthdwx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Belgium's eID Authentication Opens Citizen Accounts to RCE | daily.dev og:description: A DEF CON 34 presentation revealed severe vulnerabilities in Belgium's Connective browser extension, which underpins the country's national eID authentication... og:url: https://daily.dev/posts/belgium-s-eid-authentication-opens-citizen-accounts-to-rce-ab5rthdwx og:image: https://api.daily.dev/og/posts/ab5rthDwx.png og:image:alt: Belgium's eID Authentication Opens Citizen Accounts to RCE og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Belgium's eID Authentication Opens Citizen Accounts to RCE **[Dark Reading](https://daily.dev/sources/dr)** · 7 min read · 0 upvotes · 0 comments ## Summary A DEF CON 34 presentation revealed severe vulnerabilities in Belgium's Connective browser extension, which underpins the country's national eID authentication system used by over 60 government agencies, 8 of the 10 largest banks, and 2 million users. The extension used a replayable generic activation token instead of validating the target website, allowing attackers to steal eID authentication, PIN codes, and payment card data via any malicious site. A separate flaw in the native host software allowed arbitrary DLL loading, enabling drive-by remote code execution without any login flow involved. The vendor, Nitro Software Belgium, patched the issues on July 22. Researchers warn similar extension-based flaws exist across other vendors serving militaries, banks, and hospitals. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities were found in Belgium's Connective eID browser extension? The Connective signing extension used a generic replayable activation token instead of validating which website it connected to, letting attackers steal eID authentication, PIN codes, and Mastercard Maestro payment card data from any malicious site. A separate flaw in its native host software let any webpage load an arbitrary DLL file, enabling drive-by remote code execution. Nitro Software Belgium patched both issues on July 22. _Track how identity and authentication vulnerabilities like these get patched by following security coverage on daily.dev._ ### How could attackers exploit the itsme app after compromising a Belgian eID login? By stealing a victim's eID signature once through the Connective extension flaw, an attacker could reset the victim's itsme account and re-register it with the attacker's own phone number, gaining continuous access to all connected government, banking, and commercial accounts without needing repeated card reader logins. _daily.dev helps developers securing authentication flows stay current on identity system exploits like this._ ### Why are browser extensions considered a major security risk according to security researchers? Browser extensions are inherently unsafe because they hold powerful browser-granted capabilities while also enriching ordinary websites with ways to interact with them, letting malicious pages abuse that interaction layer to escalate privileges. Researcher Gal Weizman notes many extensions have content-script message listeners that fail to filter messages from the page itself, enabling cross-website attacks on authenticated sessions. _Developers building or auditing extensions can follow browser security research trends on daily.dev._ ## Similar posts on daily.dev - [Attacker gets into France's DB listing all bank accounts](https://daily.dev/posts/attacker-gets-into-france-s-db-listing-all-bank-accounts-w9x51rgws) · The Register · 1 upvotes · 0 comments - [1-Click RCE To Steal Your Moltbot Data and Keys](https://daily.dev/posts/1-click-rce-to-steal-your-moltbot-data-and-keys-ieiavgrhd) · Hacker News · 0 upvotes · 0 comments - [I Changed One Number… and Got Access to Citizens’ ID and Address Proofs](https://daily.dev/posts/i-changed-one-number-and-got-access-to-citizens-id-and-address-proofs-qyneutnqa) · InfoSec Write-ups · 0 upvotes · 0 comments - [COLDCARD security audit phishing attack installs remote access tool](https://daily.dev/posts/coldcard-security-audit-phishing-attack-installs-remote-access-tool-refdomo43) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/belgium-s-eid-authentication-opens-citizen-accounts-to-rce-ab5rthdwx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Belgium's eID Authentication Opens Citizen Accounts to RCE","url":"https://daily.dev/posts/belgium-s-eid-authentication-opens-citizen-accounts-to-rce-ab5rthdwx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/belgium-s-eid-authentication-opens-citizen-accounts-to-rce-ab5rthdwx"},"datePublished":"2026-08-13T07:05:18.850Z","dateModified":"2026-08-13T07:05:46.177Z","description":"A DEF CON 34 presentation revealed severe vulnerabilities in Belgium's Connective browser extension, which underpins the country's national eID authentication...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/27517f5ec91e64023ab377744d90f5e6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/27517f5ec91e64023ab377744d90f5e6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/belgium-s-eid-authentication-opens-citizen-accounts-to-rce-ab5rthdwx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Belgium's eID Authentication Opens Citizen Accounts to RCE"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/belgium-s-eid-authentication-opens-citizen-accounts-to-rce-ab5rthdwx#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities were found in Belgium's Connective eID browser extension?","acceptedAnswer":{"@type":"Answer","text":"The Connective signing extension used a generic replayable activation token instead of validating which website it connected to, letting attackers steal eID authentication, PIN codes, and Mastercard Maestro payment card data from any malicious site. A separate flaw in its native host software let any webpage load an arbitrary DLL file, enabling drive-by remote code execution. Nitro Software Belgium patched both issues on July 22. Track how identity and authentication vulnerabilities like these get patched by following security coverage on daily.dev."}},{"@type":"Question","name":"How could attackers exploit the itsme app after compromising a Belgian eID login?","acceptedAnswer":{"@type":"Answer","text":"By stealing a victim's eID signature once through the Connective extension flaw, an attacker could reset the victim's itsme account and re-register it with the attacker's own phone number, gaining continuous access to all connected government, banking, and commercial accounts without needing repeated card reader logins. daily.dev helps developers securing authentication flows stay current on identity system exploits like this."}},{"@type":"Question","name":"Why are browser extensions considered a major security risk according to security researchers?","acceptedAnswer":{"@type":"Answer","text":"Browser extensions are inherently unsafe because they hold powerful browser-granted capabilities while also enriching ordinary websites with ways to interact with them, letting malicious pages abuse that interaction layer to escalate privileges. Researcher Gal Weizman notes many extensions have content-script message listeners that fail to filter messages from the page itself, enabling cross-website attacks on authenticated sessions. Developers building or auditing extensions can follow browser security research trends on daily.dev."}}]} ```