Critical Vulnerabilities in Belgian eID Software Expose Millions to Identity Theft

Critical security vulnerabilities in Belgium's national eID middleware have exposed users from eight of the country's ten largest banks and over 60 government agencies to remote code execution and identity theft. The middleware, essential for authentication between Belgian eID smart cards and third-party services, lacks published CVE identifiers and official advisories from Belgian cybersecurity authorities. Attackers could exploit these flaws to steal credentials and execute arbitrary code on users' machines. The Belgian government has open-sourced the vulnerable middleware, allowing for public audit, but the timeline of the vulnerabilities and potential prior exploitation remains unclear. Users are advised to update to the latest version of the middleware and review authentication logs for any suspicious activity. The window of exposure is currently unknown, raising concerns about the extent of the impact.

Key Points: • Critical vulnerabilities in Belgian eID middleware expose millions to identity theft. • No CVEs or official advisories have been published, complicating verification efforts. • Users are urged to update their systems and review authentication logs for anomalies.