A security researcher has disclosed severe vulnerabilities in a Belgian digital identity browser extension known as Connective. The tool is used by more than two million people and supports critical online authentication and legally binding electronic signatures. After the findings were reported, the vendor issued remediations, and the company states the final security enforcement was completed in late July.
Although the affected component is “now resolved,” the research highlights how flaws in trust and verification logic can undermine a far larger digital ecosystem—especially when identity, payments, and signing are tightly connected.
What the Belgian eID software does
The Connective system, developed by Nitro Software Belgium, helps users authenticate their identity online and sign documents electronically. It is embedded in everyday services used by institutions such as large banks and government organizations. In total, the extension is used by eight of Belgium’s ten largest banks and by more than 60 government agencies.
Beyond convenience, this functionality has legal weight. The extension enables electronic signatures that can be treated as legally binding, which means successful abuse could have real-world consequences for identity, approvals, and account control.
Missing website verification enabled silent interaction
One of the core problems found by James Arnott was that the application did not properly verify which website was attempting to communicate with the user’s machine. In other words, the checks that should ensure requests come from an approved origin were absent.
Because of that gap, any website—or even embedded online ads—could potentially interact directly with the Connective application running on a victim’s device, without the user being aware or granting explicit permission.
Potential PIN theft and fake prompts
According to Arnott, a malicious website could silently access sensitive details tied to a connected eID, including electronic ID data and payment card information. More critically, the researcher described a scenario where attackers could persuade users to reveal their eID PIN.
The abuse method relied on authentication dialogs that looked official. Attackers could trigger pop-ups that prompted for the PIN, while the software allowed web pages to customize the text inside these dialogs without showing the requesting domain. That design removed a key safety signal: users had no straightforward way to confirm whether the prompt matched the real website they intended to use.
When a user entered their PIN into the prompt, the extension sent the PIN back to the requesting webpage. With the stolen PIN, attackers could generate unauthorized approval tokens and use them to forge legally binding electronic signatures.
In practical terms, that could occur when the victim’s physical eID card was inserted into a card reader. An attacker could then attempt to produce signatures that the victim did not knowingly approve.
Why the trust model was at risk
Such a compromise goes beyond isolated account takeover. The researcher noted that the impact could severely damage Belgium’s broader digital trust model, particularly services that depend on eID-based signatures.
Even if third-party providers themselves had no vulnerabilities, they could still be exposed because their systems rely on eID signing capabilities. The findings mention government portals such as CSAM.be and identity providers like Itsme as examples of services whose workflows could be affected if an attacker obtained signing power.
Remote code execution without inserting the card
In addition to identity-related abuse, Arnott uncovered a remote code execution vulnerability that could operate independently of whether an eID card was plugged in. The issue was tied to how the application processed files on the local computer.
The reported risk was that a malicious website could cause the software to execute attacker-controlled code at the user level. This kind of “drive-by” style attack can be particularly dangerous because it may not require elevated privileges or user actions beyond browsing.
The researcher explained that the attack could be performed by tricking a user into downloading a file disguised as a normal document, and then visiting a webpage that triggers the vulnerable processing path. The flaw also carried the possibility of spreading, including a worm-like behavior described as hijacking user credentials to distribute malicious links to other potential victims.
How the issues were remediated
According to the report, Nitro fully remediated the vulnerabilities 146 days after the initial disclosure. The company also paid a $200 bug bounty. For technical mitigation, the vendor deployed updates intended to block unauthorized origin requests and to secure PIN handling. The report states that final security enforcement was completed in late July.
Notably, the research did not mention any assigned CVEs. That means users and administrators were expected to rely on the vendor’s updates and security guidance rather than CVE tracking alone.
Nitro had not responded to the publication’s request for comment at the time of the article, but the timeline and remediation actions described indicate that the problems were addressed through application-level controls.
What this means for users and organizations
For users, the central lesson is that digital identity prompts are only safe if the surrounding context is trustworthy. When dialog text can be influenced by a website and the requesting domain is hidden, phishing risk increases dramatically. Even short-lived UI deception can be enough to capture credentials like an eID PIN.
For organizations—especially banks, government bodies, and identity service providers—the findings underscore how critical components must enforce strict origin and request verification. If a browser extension can be contacted without correct checks, attackers may not need to compromise the organization’s own infrastructure to impact users.
Because eID-backed signing can support legally binding outcomes, security reviews should include not only server-side controls, but also client-side enforcement, dialog integrity, and the correctness of how authentication materials are handled end-to-end.
Security is a chain—one flaw can affect many services
The Belgian eID software case illustrates how a single vulnerability inside an authentication and signing extension can ripple outward. Services that depend on signatures may be threatened even if they are not directly vulnerable themselves—because the trust is anchored in the signing capability.
With the reported issues now remediated, the immediate risk has been reduced. Still, the research remains a useful reminder: strong verification, transparent prompts, and hardened local processing are not optional when electronic signatures and identity credentials are involved.
As the digital ecosystem grows, so does the importance of building identity systems that assume adversaries will try everything from phishing dialogs to drive-by code execution. The best defenses combine secure software changes with user-facing cues that make deception far harder.
