CVE-2026-8993

Name of the Vulnerable Software and Affected Versions D.Launcher 2 (affected versions not specified)

Description The D.Launcher 2 component of the Slovak eID client ecosystem contains an issue with improper URL handler processing. The application registers multiple custom URL handlers that can be exploited to initiate a full NTLM authentication or an SMB connection to an attacker's infrastructure. Additionally, this can be used to conduct Server Side Request Forgery (SSRF), a technique where an attacker induces a server-side application to make requests to an unintended location. Exploitation requires user interaction, as the victim must open a specially crafted URL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.