Belgium's eID Authentication Opens Citizen Accounts to RCE

Research disclosed critical vulnerabilities in the Connective eID browser extension and its native host—used by Belgian government agencies, major banks, and millions of users—where replayable activation tokens, improperly handled PIN data, and arbitrary DLL loading could enable identity theft, payment-card hijacking, and remote code execution; the issues were fixed on July 22.