Currently, clients have the authority to state their AccountAge and MembershipType to the server, as this is done through JoinData.
All they have to do, really, is edit whatever is being sent thru and fake it that way.
This has been causing major issues in my game, as they’ve been faking their Premium subscription: getting Premium benefits without actually owning Premium (their profiles state they don’t have Premium, yet it shows it as though they do in-game); and by faking their AccountAge, getting past my AccountAge filter to instantly terrorize my game with new accounts made zero days ago.
This is a critical engine bug that must be addressed immediately, especially since many game developers are adding in Premium benefits that rely on the Player.MembershipType property and AccountAge filters that rely on the Player.AccountAge property (both of which this exploit/bug touch on).
It would be great if a Roblox engineer could reaffirm the existence of this exploit/bug and patch it as soon as possible.