Bypassing EU Age Verification

Release 2026.07-1 Highlights What's new EU Age Verification Solution Demo Prove your age You must be at least 18 years old For mobile login click here AV Wallet PoC — T-Systems/CERT 2.0.0 Security PoC: EU Age Verification bypass via software keys. For responsible disclosure only. Request Credentials for your EUDI Wallet Please select credentials Credentials mdoc format Proof of Age Grants Authorization Code Grant Pre-Authorization Code Grant Credentials Offer URI: Submit Cancel Credential active — software key, no ID verification. Age credential (eu.europa.ec.av.1) age_over_18 = true Bypasses demonstrated: No passport scanned No face match performed Software P-256 key (not StrongBox/TEE) No Play Integrity / hardware attestation One-time-use not enforced (MSO retained) Present to EC test verifier Presenting credential... Software key — no passport, no device binding Credential Accepted (HTTP 200) Credential presented from Chrome extension. No passport scanned. No face match. No hardware keys. PoC bypasses demonstrated: Software P-256 key (not StrongBox/TEE) No passport or identity document scanned No face matching performed No Play Integrity / hardware attestation Same credential reused (one-time-use bypassed) Close

A screen recording walks through a supposed EU age-verification flow: it opens a release page, installs and enables a browser extension, selects an age credential, and presents it to a QR-code verifier. The final dialog reports “Credential Accepted (HTTP 200)” despite no passport, face scan, device binding, or hardware-backed verification, turning the official-looking security demo into a deadpan bypass joke. Background music gives the technical walkthrough a brisk, almost triumphant tutorial feel, making the successful bypass feel absurdly easy.

• @gentoomemes / 21338 2026-07-14