Hello there Robloxians,
I found a vulnerability in the Age Verification system on the Roblox website. It can be engineered to that point where you can change your birthdate, which would unverify your age and likely let you verify with a new ID. That’s an issue that has to be fixed to prevent people from changing their IDs to prevent Moderation Action. Thanks to a partner of mine, we were able to test it on their alt account.
First, we open the Network tab and go into Settings. We search for a request called “verified-age”. Then we view the Response of that specific request:
It says “isVerified”:true, which makes us unable to change the birthdate. Yet there’s a workaround where we’re able to mock this HTTP Request and it surprisingly works. We right-click the request and click “Override Content” which creates a folder on our device, letting us configure the HTTP request on the client itself.
I used Notepad to change “isVerified”:true to “isVerified”:false, saved the file and refreshed the page.
As you can see, the client thinks that our age isn’t verified. Now we can click the edit button and change our age, which lets us put our birthdate to whichever birthdate we want, which unverifies our ID, letting us verify it with another one.
Voila! That shouldn’t have been possible.
Expected behavior
I expect it to be impossible to change your birthdate without requesting a birthdate change from Roblox Support