How does BB84 fare against an attacker who can entangle qubits? Consider the following attack on the BB84 quantum key exchange protocol (as far as I can tell, it should work similarly for E91):

After Alice sends her key bits encoded in qubits with randomly chosen bases, Eve intercepts them without making a measurement.

She uses her quantum computer, prepares it in a |0⟩ state and, for each bit, does a CNOT with her own qubits as targets and Alice's bits as controls, thus entangling them.

Then, she sends Alice's bits on to Bob, who measures them.
This projects them into an eigenstate of Bob's chosen base.
It also projects Eve's qubits into the same states.

After Bob and Alice have publically announced their bases, Eve measures her qubits in the same bases that Bob chose, getting the same result.

This way, she will not learn which bits Alice sent, but she will learn which bits Bob received, which is enough.
She will also not be detected when Alice and Bob compare part of their keys, because she makes her measurements only after Bob makes his.

Does this attack (theoretically) work?
If not, what's the problem?
If it does, why is BB84 considered (theoretically) secure?
After some consideration of Lukas' comment, it seems I haven't thought this through.
In fact, Eve will only entangle Bob's qubit with hers if Alice chooses the diagonal basis.
However when Bob also measures the diagonal basis, a quick calculation shows he randomly measures 0 or one, with probability 1/2 each.
So even though Eve learns which bits Bob measured, she will also introduce a 25% error chance as if she had measured them, and she will be detected.