Saberes platform vulnerability lets users obtain Mexican government certificates without completing courses

Journalist Claudio Ochoa Huerta demonstrated that Mexico’s Saberes online training platform could issue official certificates without users completing the required courses. He obtained two valid‑looking certificates – one for a data‑analysis course and another for pediatric vaccination – by exploiting a system flaw, and also generated a fake certificate in the name of President Claudia Sheinbaum. Saberes, which runs on software from Territorium Life (also used by UNAM for its admission exam), displayed QR‑coded validation that appeared authentic until the investigation was published. Hours after the report, the certificates were invalidated. The incident has raised concerns about the security and verification processes of digital education credentials, especially in sensitive fields such as health.