Research into systemic PDF417 validation vulnerabilities in AAMVA-compliant ID systems (CVE-2025-31336, CVE-2025-31337, scr1841160)

• Publication Date: July 1, 2025
• CVE Status: Published (despite CISA case closure)
• VINCE Case: VU#396042 (closed by CISA as "not a vulnerability")
• Disclosure Period: 120+ days completed
• MITRE CVE List:
  • CVE-2025-31337
  • CVE-2025-31336

CVSS v3.1 Risk Assessment

Base Score: 10.0 (Critical)
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Breakdown:

• Attack Vector: Network-exploitable via digital APIs
• Attack Complexity: Low (minimal effort required)
• Privileges Required: None (unauthenticated)
• User Interaction: None required
• Scope: Changed (affects dependent ID verification systems)
• Confidentiality Impact: High (enables unauthorized data access)
• Integrity Impact: High (complete validation bypass)
• Availability Impact: None (no direct availability impact)

Exploit Example:

Coordination History and Vendor Response Summary

Disclosure Timeline

• March 22, 2025: Initial CVE request submitted to MITRE
• March 25, 2025: IDScan.net proof-of-concept submission and acknowledgment
• March 28, 2025: TokenWorks vulnerability acknowledgment received
• April 3, 2025: CISA VINCE case VU#396042 officially opened
• April 9-16, 2025: Extensive technical discussions with affected vendors
• June 18, 2025: CISA case closure decision (dismissed as "understood risk")
• July 1, 2025: Public disclosure following extended coordination period

Vendor Responses and Technical Disagreements

IDScan.net (Joshua Sheetz, CISO/VP Engineering)

Initial Response: "After investigating this, it looks like you are just spoofing the barcode data. This is a common standard."

Technical Position:

• Claimed their parser "just reads data" and isn't responsible for validation
• Argued that impossible values (524-year-old individuals) are acceptable in a "parser"
• Dismissed implementation-specific vulnerabilities as AAMVA standard limitations
• Contradicted their own marketing claims about "hundreds of algorithmic security checks"

Marketing vs. Reality Gap:

• VeriScan website promises "Fake ID Detection / ID Authentication"
• Claims to "catch fake IDs" and perform "security checks"
• Technical analysis revealed minimal validation beyond format compliance

TokenWorks Response

• Acknowledged the issue as a "DMV implementation problem"
• Downplayed vendor responsibility for cryptographic validation
• No remediation timeline provided

CISA Decision (June 18, 2025)

Final Determination: "CISA has decided that this is not a vulnerability as it is an understood risk in the AAMVA DL Standard."

Technical Analysis of CISA's Position: This decision appears to conflate standard limitations with implementation-specific vulnerabilities. The research documented distinct technical issues:

1. Multi-Layered Vulnerability Classification:

   • Layer 1: AAMVA standard cryptographic deficiencies (acknowledged)
   • Layer 2: Implementation-specific validation failures (dismissed by CISA)
   • Layer 3: Marketing claims vs. actual security capabilities (not addressed)

2. Implementation-Specific Issues Documented:

   • CWE-20 (Improper Input Validation): Accepting physiologically impossible values
   • CWE-345 (Insufficient Verification of Data Authenticity): No cryptographic checks
   • CWE-770 (Allocation of Resources Without Limits): No rate limiting
   • CWE-841 (Improper Enforcement of Behavioral Workflow): No pattern detection

Proof of Concept Validation Evidence

Missouri ShowMeID Government Application Bypass

Missouri ShowMeID bypass evidence

Impact: Complete bypass of Missouri's official government ID verification application, demonstrating systemic vulnerabilities in state-level identity verification systems.

VeriScan Enterprise Validation Bypasses

California License Validation Failures

Arizona License Validation Bypasses

Florida License Validation Failure

Georgia License Validation Bypass

New Jersey License Validation Failure

South Carolina License Validation Bypass

Texas License Validation Failure

Texas bypass evidence - demonstrates consistent vulnerability pattern across state implementations

Technical Evidence and Vendor Rebuttals

Documented Vulnerabilities

1. Temporal Validation Bypass

Finding: VeriScan accepts birth dates from medieval times (e.g., year 1500) Vendor Response: "Where do you draw the line, especially in just a parser" Technical Counter: Human physiological limits provide clear validation boundaries (max ~122 years)

2. Pattern Detection Failure

Finding: Same license number with different names accepted repeatedly Vendor Response: "We would not know if the first or second scan was real" Technical Counter: Pattern detection flags suspicious behavior regardless of which is authentic

3. Marketing Claims Discrepancy

Finding: Product marketed as providing "security checks" and "fake ID detection" Vendor Response: "Using only our parsing tool...you are limited to what feature sets you have" Technical Counter: Marketing materials explicitly claim validation capabilities

4. Commercial License Implications

Finding: CDL (Commercial Driver's License) bypass poses public safety risks Vendor Response: Not specifically addressed Technical Impact: Hazmat/transport credential spoofing potential

CVE-2025-31337: IDScan.net Validation Flaw

Affected Products

• VeriScan enterprise validation platform
• VSCloud Enterprise cloud-based verification
• Mobile verification applications using IDScan APIs

Vulnerability Details

Core Technical Issues:

1. Temporal Validation Failure:

   • Accepts physiologically impossible birth dates (e.g., year 1500)
   • No upper bound validation for age calculations
   • Future issue/expiration dates pass validation

2. Header-Only Verification:

   • Validates AAMVA format compliance over content authenticity
   • Missing cryptographic signature verification
   • Static field validation without logical consistency checks

3. Static IIN Acceptance:

   • No real-time issuer database cross-checking
   • Accepts valid state IINs (e.g., 636014=CA) with synthetic data
   • Missing verification against authoritative DMV records

CVE-2025-31336: TokenWorks ID Validation Vulnerability

Affected Products

• IDentiFake Plus verification terminal
• AgeVisor Series age verification devices
• IDVisor Sentry security scanning systems
• All current versions across product line

Vulnerability Details

Root Cause:
Improper validation of PDF417 barcode temporal data fields and subfile markers enables complete synthetic ID generation that bypasses TokenWorks validation systems.

Technical Exploitation Vectors:

1. Birth Date Field Manipulation:

   • System accepts dates from 1400-2025 without validation
   • No physiological boundary checking implemented
   • Medieval dates (e.g., 1400s) pass as legitimate

2. Subfile Offset Forgery:

   • Forged ZC/ZF/ZG state-specific markers accepted
   • Calculated offsets bypass format validation
   • Missing cross-reference validation against known patterns

Systemic Vulnerabilities in AAMVA ID Standards

Root Cause Analysis

The vulnerabilities stem from fundamental gaps in the AAMVA DL/ID-2020 Standard:

Critical Standard Deficiencies:

• No cryptographic validation requirements: Missing digital signature specifications
• Inadequate temporal range checks: Section 4.3.2 lacks year validation requirements
• Format compliance prioritized over data authenticity: Parsing correctness valued over content verification

Affected Systems Matrix

Repository Structure

Core Security Vulnerabilities

The fundamental vulnerabilities manifest across multiple layers of the identity verification ecosystem:

1. Format-Only Validation Approach

Technical Issue: Verification systems validate AAMVA format compliance without authenticating data content or origin.

Impact: Completely synthetic credentials can pass validation if they maintain proper PDF417 structure and state-specific formatting.

2. Missing Database Cross-Reference

Technical Issue: Systems fail to verify that barcode information matches authoritative records at issuing agencies.

Impact: Enables creation of credentials with valid formatting but completely fabricated personal information.

3. Header/Offset Manipulation Vulnerability

Technical Issue: By calculating technically correct offset values while using synthetic data, fabricated credentials bypass parsing validation.

Impact: Sophisticated attackers can generate credentials that pass both format and basic consistency checks.

4. Temporal Logic Validation Failures

Technical Issue: Systems accept physiologically and logically impossible values (medieval birth dates, future issue dates).

Impact: Demonstrates fundamental absence of basic sanity checking in verification workflows.

5. Commercial License Security Gaps

Technical Issue: Enhanced-security documents like Commercial Driver's Licenses are equally vulnerable to the same exploitation techniques.

Impact: Poses significant public safety risks through potential hazmat/transport credential spoofing.

State Implementation Analysis

This research includes comprehensive implementations for seven states, demonstrating consistent vulnerability patterns across different encoding schemes:

California (california.rs, california_cdl.rs)

• Format: ZC subfile with unique document discriminator pattern
• CDL Capabilities: Specialized commercial driving endorsements (HNX - Hazmat/Tank/Double-Triple)
• Vulnerability: Temporal validation bypass allows medieval birth dates without detection

Florida not available (florida.rs)

• Format: ZF subfile with state-specific offset calculations
• Unique Features: Special document discriminator generation algorithm
• Vulnerability: Date formatting allows impossible temporal values

Georgia (georgia.rs)

• Format: ZG offset format with county information fields
• Implementation: Duplicated address information across multiple subfiles
• Vulnerability: Algorithm-generated license numbers can be reverse-engineered

Illinois not available (illinois.rs)

• Format: ZI offset format with supplemental data fields
• Implementation: Special pattern-based document discriminator
• Vulnerability: Redundant fields not properly validated for consistency

New Jersey (new_jersey.rs)

• Format: ZN offset format with derived field calculations
• Implementation: Prefix formatting for names and special numerical fields
• Vulnerability: Derivation algorithms can be replicated for synthetic credentials

South Carolina (south_carolina.rs)

• Format: No subfile designator (uses DLDCA rather than DLDAQ)
• Unique Feature: Different field ordering from other states
• Vulnerability: Security field patterns not properly validated

Texas (texas.rs)

• Format: ZT subfile format unique to Texas
• Implementation: Complex document discriminator derived from multiple fields
• Vulnerability: Inventory control number validation weakness

Implementation Note: Modifiable Values

Throughout the state implementations, certain values can be modified without breaking validation:

• '9' sequences: Fields using 999999999 can be modified with arbitrary values
• 'X' placeholders: Fields using XXXXX can be replaced with any characters
• Temporal fields: Any dates can be modified, including impossible values (medieval birth dates, future issue dates)
• Personal information: Names, addresses can be completely fabricated

This flexibility highlights the lack of comprehensive data validation in affected systems.

Technical Implementation Examples

Creating Synthetic Test Credentials

The implementation provides builder patterns for each state:

Testing and Validation

Installation and Usage

Prerequisites

1. Rust and Cargo installed on your system
2. Required dependencies (listed in Cargo.toml)

Installation

Scanning Generated Barcodes

Generated barcodes will be saved as PNG files that can be presented to verification systems for testing:

AAMVA Standard Reference Implementation

Physical Characteristic Codes

Eye Color Standards:

• BLK - Black
• BLU - Blue
• BRO/BRN - Brown
• GRY/GRA - Gray
• GRN - Green
• HAZ/HZL - Hazel
• MAR - Maroon
• MUL - Multicolored
• PNK - Pink
• DIC - Dichromatic
• UNK - Unknown

Hair Color Standards:

• BAL - Bald
• BLK - Black
• BLN/BLD - Blonde
• BRO/BRN - Brown
• GRY/GRA - Grey
• RED/AUB - Red/Auburn
• SDY - Sandy
• WHI - White
• UNK - Unknown

State Issuer Identification Numbers (IINs)

• California: 636014
• Florida: 636010
• Georgia: 636055
• Illinois: 636035
• New Jersey: 636036
• South Carolina: 636430
• Texas: 636015

Key Research Findings

1. Systemic Vulnerability Pattern: Consistent validation failures across multiple vendors and platforms
2. Cryptographic Security Absence: No tested systems implement cryptographic data validation or digital signatures
3. License Duplication Capability: Same license numbers can be used with different personal information without detection
4. Dimensional Optimization Requirements: Each state requires specific PDF417 barcode dimensions for optimal scanner recognition
5. Public Safety Implications: Commercial driver's license spoofing capability poses significant transportation security risks
6. Coordination Process Inadequacies: Industry and regulatory responses demonstrate systemic vulnerability disclosure process gaps

Verification and Authenticity

To verify the authenticity and integrity of this research:

GPG Signature Verification

PGP Fingerprint: 2EFA A479 1439 CF35 47A9 6680 1ECC 2986 AF90 3402

Research Methodology and Ethics

Responsible Disclosure Approach

Despite vendor dismissals and CISA case closure, this research maintains responsible disclosure principles:

1. Extended Coordination Period: 120+ days (exceeding standard 90-day period)
2. Synthetic Data Only: All demonstrations use clearly marked research data
3. Vendor Engagement: Extensive technical discussions and proposed solutions
4. Public Safety Focus: Emphasis on defensive improvements rather than exploitation

Technical Validation Standards

All findings were validated against:

• NIST SP 800-63B identity verification guidelines
• NIST Cybersecurity Framework v1.1 security controls
• CWE/SANS Top 25 vulnerability classifications
• ISO/IEC 29147 disclosure standards

References and Standards

Technical Standards and Guidelines

• AAMVA DL/ID Card Design Standard - Official AAMVA implementation specifications
• NIST SP 800-63B Identity Verification Guidelines - Federal identity verification standards
• NIST Cybersecurity Framework v1.1 - Cybersecurity implementation guidance
• CWE/SANS Top 25 Most Dangerous Software Errors - Vulnerability classification framework
• ISO/IEC 29147 Vulnerability Disclosure - International disclosure standards

Coordination and Publication References

• MITRE CVE Program - Vulnerability coordination and publication
• CISA Vulnerability Disclosure Policy - Federal coordination framework

Limitations and Ethical Considerations

Technical Limitations

1. Physical Security Feature Absence: Generated barcodes lack physical security features (holograms, RFID, special inks)
2. Legal Compliance Requirements: All demonstrations use synthetic data with "RESEARCH USE ONLY" watermarks
3. Coordination Challenges: Industry resistance to addressing implementation-specific vulnerabilities
4. Regulatory Framework Gaps: Limited existing frameworks for addressing systemic validation security issues

Ethical Research Boundaries

1. Synthetic Data Exclusive Use: No real personal information used in any demonstrations
2. Educational Purpose Focus: Research aimed at improving defensive security capabilities
3. Responsible Disclosure Compliance: Extended coordination periods and collaborative vendor engagement
4. Public Safety Priority: Emphasis on protective improvements rather than exploitation enablement

Future Research Directions

Technical Improvements Needed

1. Cryptographic Validation: Implementation of digital signature verification
2. Behavioral Analytics: Pattern detection for suspicious scanning behavior
3. Database Integration: Real-time cross-referencing with issuing authorities
4. Multi-Factor Validation: Combining physical and digital verification methods

Policy and Coordination Improvements

1. Vulnerability Classification: Better frameworks for standard vs. implementation issues
2. Industry Accountability: Clearer responsibility models for security claims
3. Public Safety Integration: Enhanced consideration of real-world impact
4. International Coordination: Cross-border identity verification standards

Responsible Disclosure and Public Interest

This research is published in the public interest following extensive coordination efforts. Publication decision factors:

1. Extended Coordination Commitment: 120+ days of good-faith vendor and regulatory engagement
2. Public Safety Risk Assessment: Commercial license spoofing capabilities pose significant transportation security risks
3. Technical Merit Validation: Documented implementation-specific vulnerabilities requiring industry attention
4. Educational Value Provision: Research improves security awareness and defensive capability development

Ongoing Vendor Engagement

Despite coordination disagreements, the researcher remains available for:

• Technical implementation improvement assistance
• AAMVA standard enhancement support and collaboration
• Defensive security measure development
• Additional technical analysis provision as needed

Contact and Coordination

Research Contact Information

• Primary Email: [email protected] (PGP encryption preferred)
• GitHub Profile: github.com/coleleavitt
• LinkedIn: linkedin.com/in/coleleavitt

Ongoing Coordination Channels

• MITRE CVE Program: [email protected]
• CISA Vulnerability Disclosure: [email protected]
• VINCE Case Reference: VU#396042 (closed, but documentation available)

License and Legal Framework

This research is provided under a comprehensive Security Research License. See LICENSE.md for complete terms and conditions.

Research Objective: This research was conducted with the goal of improving security across the identity verification ecosystem. While coordination efforts encountered significant challenges, the technical findings remain valid and require industry attention to protect public safety and national security interests.

Legal Compliance: All research activities comply with applicable laws including the Computer Fraud and Abuse Act (CFAA), Digital Millennium Copyright Act (DMCA), and relevant state and federal identity document regulations. No real personal information was used, and all demonstrations employ clearly marked synthetic research data.

Note: This research was conducted with the goal of improving security across the identity verification ecosystem. While coordination efforts encountered challenges, the technical findings remain valid and require industry attention to protect public safety and national security interests.