The European Commission released source code of an EU Age Verification App as a white-label reference implementation on 15 April 2026.
EU Age App Hacked in 2 Minutes and EUDI Wallet Impact ↗
What happened
- Security researcher Paul Moore reported bypassing PIN and biometric controls by editing a plain-text configuration file.
- An Italian researcher reportedly reproduced the findings and documented five additional vulnerabilities.
- The Commission has stated that the released version is a demo and the code will continue to evolve.
Why it matters to Signicat
- Gataca argues a compliant private age-verification market with wallet models already exists and should be preferred over public implementations.
- Gataca frames the incident as a reputational risk for EUDI Wallet adoption, a narrative relevant to Signicat's Wallet Hub positioning.
Evidence from the source (5 quotes)
- “By editing a plain-text XML configuration file, he was able to reset the user PIN, disable biometric authentication via a single boolean flag, and retain access to stored credentials.” source ↗
- “An Italian researcher subsequently reproduced his findings and documented five additional vulnerabilities.” source ↗
- “The Commission has clarified that the released version is a demo, and that the code will continue to evolve.” source ↗
- “A compliant private market for age verification with digital identity wallets already exists in Europe today.” source ↗
- “It has put pressure on trust in the EUDI Wallet before it has even rolled out.” source ↗
EUDI wallet eIDAS 2Age verificationPositioning narrativeThought leadershipCompetitive attackGlobal
4 of 4 facts verified against the source · confidence high · claude-haiku-5-5