Critical Flaw in EU Age Verification App Lets Attackers Bypass Checks

Key Takeaways

• A critical design flaw has been identified in the EU’s age verification application (version 2026.07-1).
• The vulnerability allows attackers to bypass age checks by replaying anonymous “over 18” attestations.
• The core issue stems from the app’s privacy-preserving design, which prevents linking age proofs to specific user identities or sessions.
• Security researcher Paul Moore demonstrated the bypass using a Chrome extension developed with #ClaudeAI.
• While the app has received security updates, the fundamental architectural problem remains unaddressed, rendering the system vulnerable to replay attacks.

EU Age Verification App Bypassed Again, Fundamental Flaw Exposed

A significant security flaw has been uncovered in the European Union’s age verification system, allowing attackers to circumvent age checks despite recent security enhancements. Security researcher Paul Moore has once again demonstrated a bypass, targeting the latest app release (version 2026.07-1) through an innovative method involving a Chrome extension powered by #ClaudeAI.

Moore’s proof-of-concept illustrates that, even after months of “security hardening,” a foundational design flaw persists within the anonymous age verification model. This flaw permits the reuse of “over-18” attestations without establishing a definitive link to a genuine user identity.

Replay Attack Exploits Anonymous Attestations

In a recently published video on X, Moore details how the updated #EU #ageVerification app can be deceived into repeatedly accepting the same “over 18” token within a browser context. This circumvents the need for fresh verification or identity association. Moore highlighted the issue, stating: “Bypassing the latest #EU #ageVerification app (2026.07-1) with a Chrome extension… again. Despite 3 months of security hardening and genuine improvements across the board, the fundamental issue cannot be solved. Anonymous age verification doesn’t work. https://t.co/NSfvuQAeXz pic.twitter.com/hwRTxiZiwZ” (July 14, 2026).

Rather than attempting to compromise cryptographic elements or server-side checks, the Chrome extension operates by intercepting and replaying the anonymous age proof whenever a website initiates an age verification request. This allows a single successful attestation to be effectively reused across multiple browsing sessions.

The core weakness exploited by the extension lies in the app’s design: it is intended to confirm only that a user exceeds a specific age threshold while deliberately omitting personal identifying information. Consequently, the relying website never receives confirmation that the age proof corresponds to the individual currently interacting with the system. This inherent separation between the age assertion and the user’s identity creates the vulnerability.

Moore further elaborated on the ease of creating the bypass, noting: “Notes: This PoC was created entirely by #ClaudeAI in a matter of minutes. Don’t focus on enrolment (that part is invalid in a test environment). Instead, focus on the presentation and the fact the verifier has *absolutely no information* other than an “over 18″ attestation, so…” (July 14, 2026).

Privacy Goals Clash with Security Requirements

The heart of this issue stems from the EU’s policy objective: to implement “privacy-preserving” age checks that do not transmit names, identification numbers, or other sensitive data to websites. From a technical perspective, this translates into an anonymous attestation model, where the verifying party receives a binary confirmation, such as “user is over 18,” instead of a comprehensive identity profile.

Moore’s bypass demonstrates that, in practical application, this anonymity hinders the robust binding of the attestation to the user and their specific session. If a single valid “over-18” token can be captured and replayed, the system loses its ability to differentiate between legitimate usage and malicious exploitation.

The outcome is a scenario where any individual with technical proficiency, or a malicious actor, can effectively transform one genuine verification into a universal “adult access pass” applicable across numerous websites and contexts.

Architectural Flaw Beyond Incremental Patches

EU officials have previously stated that the app has undergone three months of security enhancements, including improvements to secret storage and strengthened client-side protections. However, Moore contends that incremental patches are insufficient to resolve the underlying architectural problem. He argues that the trust model continues to rely on anonymous, reusable proofs with limited contextual information, making it inherently susceptible to replay attacks and automation.

From the perspective of security engineering, this situation is not merely a “bug” but rather a fundamental architectural mismatch between the demands for user privacy and the requirements for effective enforcement. For website operators anticipating EU age verification mandates, Moore’s research serves as a critical warning: relying solely on the official application may not provide the intended level of protection. Attackers do not necessarily require zero-day exploits or sophisticated malware; they can leverage readily available browser automation and extension logic to bypass policy controls at the integration layer.

What You Should Do

• Understand the Limitations: Website operators implementing EU age verification should be aware that the current official app, due to its privacy-preserving design, is susceptible to replay attacks.
• Implement Multi-Factor Verification: Consider supplementing the EU app with additional verification layers or checks that tie the age attestation to the active user session or device, if permissible under privacy regulations.
• Monitor for Abnormal Activity: Implement robust logging and anomaly detection to identify patterns indicative of repeated attestation use from unusual sources or across multiple, unrelated services.
• Stay Informed: Regularly check for official updates and guidance from EU authorities regarding the age verification system and any proposed architectural changes to address these fundamental security concerns.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.