EU’s New Age Verification App Can Be Hacked Within 2 Minutes, Researchers Claim

The European Commission’s Digital Age Verification App contains critical design flaws: encrypted PINs stored in an editable local shared_prefs file can be reset (deleting PinEnc/PinIV) to allow full authentication bypass, the brute-force counter can be reset to bypass rate limits, and a boolean flag can disable biometric checks. A UK researcher demonstrated a complete authentication bypass in under two minutes, the app is in pilot in several EU states and serves as a prototype for the broader Digital Identity Wallet, and no official patch had been issued as of April 17, 2026.