Improper URL Handler Processing Vulnerability in D.Launcher Component of Slovak eID Client

CVE-2026-8993

What is CVE-2026-8993?

The D.Launcher component of the Slovak eID client ecosystem contains a vulnerability that arises from improper URL handler processing. This flaw allows an attacker to register multiple custom URL handlers, which can be leveraged to initiate unauthorized NTLM authentication or establish SMB connections to malicious infrastructure. Furthermore, it opens the door to server-side request forgery (SSRF) attacks. For exploitation, user interaction is necessary, as the target must open a specially crafted URL.

References