Researchers expose major security flaws in Belgium’s eID signing software

Researchers have disclosed a series of critical vulnerabilities in software widely used to access Belgium’s electronic identity cards, warning that flaws in a trusted signing component undermined core security assumptions behind the country’s digital identity ecosystem.

The vulnerabilities, presented at Defcon 43 in Las Vegas, affected the Connective signing extension developed by Nitro Software Belgium. The software is used by more than two million people, eight of Belgium’s ten largest banks and over 60 government agencies to connect websites with Belgium’s eID and Maestro smart cards.

The flaws allowed any website to read sensitive eID data and, in the most serious case, execute malicious code on a user’s machine. Researchers told Defcon the extension forwarded commands to its native host without verifying their origin. As a result, any site or iframe could access full eID details including names, addresses, national registry numbers and photos.

The most severe flaw enabled drive‑by remote code execution. A malicious site could force the native binary to load an attacker‑supplied library, appearing to the user as a harmless file download. The extension’s activation token was not tied to a website origin so any site could replay a valid token and issue commands to the smart card. Nitro acknowledged the missing origin binding but rated the issue “medium severity.”

The weaknesses undermine core assumptions of Belgium’s eID system, the researchers warn. Namely, that PINs are entered only into trusted software, and keys are used only for intended actions.

As PIN recovery and command execution is possible from any site, attackers could obtain government‑verified identity data and generate qualified eIDAS signatures, which carry the same legal weight as handwritten ones.

The flaws also pose risks to Belgium’s Itsme digital identity platform. Used for banking, tax services and government portals, Itsme accounts can be activated with an eID. Researchers say that attackers could potentially block a victim’s account and re‑enable it using a phone they control.

They demonstrated a takeover of a CSAM.be account using the same Connective system. “None of this would be the fault of Itsme,” they said. “It’s all because of mistakes made by Connective, Nitro.”

Trusted software becomes the weak link

Nitro Software Belgium is a Qualified Trust Service Provider under EU eIDAS rules, which is  the highest trust tier. The researchers questioned how such flaws went undetected despite annual penetration tests, noting that the issues required only basic security review.

Nitro took 146 days to fully fix the vulnerabilities, according to Am I Being Pwned? (by Bay Areas Labs). An initial patch on May 8 added origin checks but did not stop remote code execution or PIN‑token leakage.

They flagged the incomplete fix the same day. A full patch arrived on June 1, disabling the vulnerable library command and replacing the PIN token with a UUID. Remote origin checks were enforced from July 22nd, preventing silent eID reads and PIN phishing.

Nitro responded to researchers, did not attempt to impose an NDA and ultimately fixed the issues, though slowly, according to the researchers. When asked about a bounty, Nitro offered $200.

The case highlights broader problems, according to Am I Being Pwned? Many extensions use similar native‑host communication models. But this exposes banks and government systems to risk.

They argue that Qualified Trust Service Providers should face stricter requirements for competent security testing, calling current oversight “security theater.” They also thanked Belgium’s Centre for Cybersecurity for approving publication under safe‑harbor protections.

Nitro responds

“In early 2026, as part of our bug bounty program an independent security researcher reported vulnerabilities in the browser extension and local signing component that enable Belgian eID signing in Nitro Sign Enterprise Verified and identification in Identity Service. We investigated, developed fixes, and a series of remediations were deployed, with the final hardening enforced in production in July 2026. The vulnerabilities are now resolved,” the company responded in an official statement.

“We found no evidence that any of these vulnerabilities were exploited. The vulnerabilities were reported to the Centre for Cybersecurity Belgium, and we coordinated closely with them throughout the process.

“Customers running current versions are protected. The fixes are distributed automatically through the Nitro plugin installer, which delivers the updated SignID component and the current browser extensions. Any customer running an older on-premise deployment can contact our team at service@gonitro.com for assistance in confirming they are up to date.”

Article Topics

cybersecurity  |  digital ID  |  e-ID  |  Itsme  |  Qualified Trust Service Provider (QTSP)