8 out of 10 Banks HATE This One Weird 3SKey RCE

Reddit •/u/acorn222 • October 2, 2026

TL;DR. SConnect - 1M+ users, an extension middleware+native host for authentication with eIDs, 3SKeys and other hardware signing tokens had a drive-by RCE which enabled any site or iframe a user saw to silently download and execute a dll due to a poor hand-rolled implementation of RSA-2048 token validation, enabling a use of uninitialized memory validation bypass which enabled "plugins" (DLLs) to be loaded. v2.16.0.0 of the extension and native host is vulnerable. CVE-2026-18397 . CVSS 9.4. submitted by /u/acorn222 [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RCE Vulnerability in SConnect Affects Banks SConnect, an authentication middleware with over 1 million users, has a remote code execution (RCE) vulnerability (CVE-2026-18397) due to a flawed RSA-2048 token validation implementation. This flaw allows any site or iframe viewed by an user to silently download and execute a DLL, exploiting uninitialized memory validation bypasses. The vulnerable version is v2.16.0.0 of both the extension and native host. The vulnerability was published on October 1, 2026, with a CVSS score of 9.4, indicating a severity. While the exact number of affected banks is unclear, the potential impact could be significant given the architecture's risks. The vulnerability highlights the dangers of extension and native host implementations in authentication systems. 1 sources 67

Extracted Entities

8 out of 10 Banks HATE This One Weird 3SKey RCE

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)