A newly introduced European Union age-verification application is facing serious security concerns after a researcher demonstrated that its protections can be bypassed in under two minutes.
The app, designed to verify user age while preserving privacy, was recently praised by EU officials as a secure and transparent solution.
However, independent security analysis suggests that the application contains critical design and cryptographic flaws that could expose sensitive identity data.
Security consultant Paul Moore reviewed the app’s open-source code and quickly identified weaknesses in how it handles user authentication and local data storage.
According to Moore, the core issue lies in how the application creates, encrypts, and stores user PINs.
During setup, the app encrypts the user’s PIN and stores it locally in a configuration directory known as shared preferences.
While encryption is applied, Moore noted that storing such sensitive data locally is already a risky design choice.
More critically, the PIN is not securely linked to the encrypted identity vault that stores user credentials.
This separation allows attackers with local device access to manipulate configuration files and bypass authentication entirely.
Moore demonstrated that by simply deleting specific encryption values labeled “PinEnc” and “PinIV” from the shared preferences file and restarting the app, the system prompts for a new PIN.
Once reset, the attacker gains full access to the original user’s identity credentials, effectively hijacking the account.
In addition to the PIN bypass flaw, Moore uncovered two other major vulnerabilities within the same configuration file:
- Rate-limiting protections can be disabled by resetting a counter value, allowing unlimited PIN guessing attempts without lockout.
- Biometric authentication can be turned off by changing a simple “UseBiometricAuth” value from true to false.
These flaws highlight a broader issue in the app’s architecture, where critical security controls rely on locally stored, easily editable configuration data.
The findings directly contradict recent statements by European Commission President Ursula von der Leyen, who described the application as technically ready and aligned with the highest global privacy standards.
The app’s open-source nature was also cited as a strength, enabling public verification of its security.
However, Moore warned that releasing the application in its current state could lead to large-scale identity breaches.
He emphasized that relying on local storage for enforcing security mechanisms like authentication and rate limiting is a well-known anti-pattern in mobile application development.
Security experts now suggest that the application requires a complete architectural redesign, particularly in how it manages identity binding, secure storage, and authentication logic.
Until these issues are addressed, the EU’s age verification initiative risks becoming a significant cybersecurity liability rather than a privacy-preserving solution.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1).webp?fit=1600,900&ssl=1&description=The app, designed to verify user age while preserving privacy, was recently praised by EU officials as a secure and transparent solution.){kind=link}