Critical RCE and Credential Theft Vulnerabilities in Belgian eID Middleware (Fedict/eid-mw) Impacting Banks and Government Systems

Executive Summary

Critical vulnerabilities have been identified in the Belgian eID Middleware (also known as Fedict/eid-mw), the authentication backbone for Belgium’s national digital identity system. This middleware, deployed across eight of Belgium’s ten largest banks and more than 60 government agencies, was susceptible to remote code execution (RCE) and credential theft. The flaw enabled attackers to potentially hijack authentication sessions, steal eID credentials, and execute arbitrary code on citizen endpoints. The vulnerability’s exposure window is undetermined, but it was publicly disclosed at DEF CON 34 and subsequently patched. No CVE identifier has been assigned, and no official Belgian government advisory is available at the time of writing. The Belgian government has since open-sourced the middleware, enhancing transparency but not retroactively mitigating the risk period.

Technical Information

The affected component is the Belgian eID Middleware (Fedict/eid-mw), including browser extensions and middleware libraries facilitating eID authentication. The vulnerability is classified as remote code execution (RCE) and credential theft. Attackers able to interact with the authentication endpoint during an active session could exploit the flaw to execute arbitrary code and exfiltrate eID credentials. The attack surface included endpoints of citizens using eID for banking and government services. The vulnerability was present in all versions prior to v5.0.8, as confirmed by the official Fedict/eid-mw GitHub releases. The flaw was disclosed at DEF CON 34, but no CVE has been published, and no official advisory from CERT.be or the Centre for Cybersecurity Belgium (CCB) exists as of this report.

The Belgian federal government has transitioned the middleware to open source under the Fedict organization on GitHub, allowing for public scrutiny and future transparency. However, this move does not address the period of unmitigated exposure prior to the patch.

Exploitation in the Wild

There is no public confirmation of exploitation in the wild. The vulnerability was presented at DEF CON 34, and while proof-of-concept details were discussed, no evidence of active exploitation or weaponized attacks has been published in open sources. The lack of a CVE and absence from the CISA Known Exploited Vulnerabilities (KEV) catalog means there is no authoritative confirmation of exploitation. Nevertheless, the criticality of the flaw and its presence in national identity infrastructure make it a high-value target for threat actors.

APT Groups using this vulnerability

No public attribution to any Advanced Persistent Threat (APT) group has been made. The strategic value of the Belgian eID Middleware as a national identity platform suggests it would be of interest to state-sponsored actors, but as of this writing, there is no evidence or reporting linking any known APT group to exploitation of this vulnerability.

Affected Product Versions

All versions of Fedict/eid-mw prior to v5.0.8 are considered vulnerable. This includes v5.0.7, v5.0.6, v5.0.5, v5.0.4, v4.4.24, and all earlier releases. The patched version, v5.0.8, was released on August 16, 2026. Organizations and individuals using any earlier version should consider themselves at risk and upgrade immediately.

Workaround and Mitigation

Immediate action is required: update the eID middleware to version v5.0.8 or later, available from the official Belgian government portal or the Fedict GitHub repository. Organizations integrating eID authentication must verify with their vendors or development teams that the patched version is deployed across all endpoints. It is strongly recommended to audit authentication logs for anomalous session activity during the period before the patch was released and to monitor for further advisories from CERT.be and the Centre for Cybersecurity Belgium. Ongoing endpoint monitoring for signs of unauthorized code execution or credential access is also advised.

Indicators of Compromise

The following table presents real indicators of compromise (IOCs) extracted from public sources. These IOCs are point-in-time and should be validated before enforcement in your environment.

References

eBuilderSecurity: Critical Flaws in Belgian eID Software Exposed Millions of Bank and Government Users, SecurityWeek: Critical Flaws Discovered in Belgian eID Software Used by 2 Million People, Fedict/eid-mw GitHub Repository, DEF CON 34 Presentation (Reddit summary), Dark Reading: Belgium's eID Authentication Opens Citizen Accounts to RCE

Rescana is here for you

Rescana empowers organizations to manage third-party risk and supply chain security with our advanced TPRM platform, providing continuous monitoring, automated risk assessment, and actionable intelligence. We are committed to supporting your cybersecurity resilience and are happy to answer any questions at info@rescana.com.