UK-based security researcher Paul Moore has disclosed a series of vulnerabilities in the EU’s age verification app, right after the European Commission declared the app technically ready for member-state deployment. The flaws include authentication bypasses, unencrypted biometric storage, and forgeable verification payloads that relying services accepted.
Moore’s disclosure covers multiple issues in the Android implementation distributed via GitHub. The PIN protecting access to the app can be reset by deleting encrypted PIN entries from the eudi-wallet.xml file in the Android shared_prefs directory; a new PIN can then be set while the original credentials and attestations remain accessible. The PIN guess counter can be reset to zero by modifying the same storage files, enabling unlimited PIN guessing. A boolean flag in storage can be toggled to disable biometric authentication checks entirely.
More significant for the EU’s privacy claims, Moore reports that facial images read from ID document DG2 data via NFC are stored as unencrypted PNG files on disk, and that selfie images written to external storage are never deleted. The Commission’s public description of the app emphasized that no personal data is stored and that the verification flow is fully anonymous; the findings directly contradict that positioning.
Moore also demonstrated a browser extension that detected verification QR codes in relying-service flows and returned forged over-18 attestations. Those forged payloads were accepted by the services tested, indicating that device binding and identity binding between the app and the attestation are weaker than the documented design requires.
The European Commission declared the app technically ready on April 14, naming Ireland, France, Denmark, Greece, Italy, Spain, and Cyprus as frontrunner member states moving toward national wallet integration. The app is open source, architected to integrate with the broader EU Digital Identity Wallet program, and was positioned as a reference implementation for privacy-preserving age checks under the Digital Services Act.
The app was developed by a consortium led by Scytáles and Deutsche Telekom. Neither the Commission, Scytáles, nor Deutsche Telekom has issued an official response to Moore’s disclosures as of April 17. The Commission’s published EUDI Wallet age verification use case manual specifies the cryptographic and privacy properties the implementation is intended to provide.
The timing places pressure on the Commission and its member-state partners ahead of the broader EU Digital Identity Wallet rollout, scheduled for completion by the end of 2026. Germany has separately proposed making the EUDI Wallet a mandatory age gate for social media, a policy position that depends on the underlying implementation meeting the security and privacy claims the Commission has made for the reference app.
Sources: CyberInsider
–
By Ji-seo Kim
