PDF417 ID Validation Vulnerability Research

Overview

This repository contains comprehensive security research documenting critical vulnerabilities in AAMVA-standard PDF417 barcode validation systems affecting government IDs, enterprise solutions, and consumer applications. The research includes a fully functional Proof of Concept (PoC) demonstrating systemic flaws in how ID verification systems process driver's license barcodes.

IMPORTANT: This code is provided for security research purposes only. See the LICENSE.md file for allowed usage.

Research Ethics Statement

This research was conducted following:

• Coordinated vulnerability disclosure principles
• 120+ day vendor notification period (exceeded standard 90 days)
• Synthetic data only (no real personal information)
• Educational/defensive security purposes
• ISO/IEC 29147 vulnerability disclosure standards
• Responsible disclosure through MITRE CVE Program and CISA VDP

Related CVEs

This research demonstrates vulnerabilities assigned:

• CVE-2025-31337 - IDScan.net validation flaw
• CVE-2025-31336 - TokenWorks validation vulnerability

Publication Status

• Publication Date: July 1, 2025
• CVE Status: Published (despite CISA case closure)
• VINCE Case: VU#396042 (closed by CISA as "not a vulnerability")
• Disclosure Period: 120+ days completed
• MITRE CVE List:
  • CVE-2025-31337
  • CVE-2025-31336

CVSS v3.1 Risk Assessment

Base Score: 10.0 (Critical)
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Breakdown:

• Attack Vector: Network-exploitable via digital APIs
• Attack Complexity: Low (minimal effort required)
• Privileges Required: None (unauthenticated)
• User Interaction: None required
• Scope: Changed (affects dependent ID verification systems)
• Confidentiality Impact: High (enables unauthorized data access)
• Integrity Impact: High (complete validation bypass)
• Availability Impact: None (no direct availability impact)

Exploit Example:

// Temporal validation bypass demonstration
let license = CaliforniaLicense::builder()
    .birth_date("06201500") // Year 1500 - Medieval era
    .validate(); // Returns OK in affected systems

Coordination History and Vendor Response Summary

Disclosure Timeline

• March 22, 2025: Initial CVE request submitted to MITRE
• March 25, 2025: IDScan.net proof-of-concept submission and acknowledgment
• March 28, 2025: TokenWorks vulnerability acknowledgment received
• April 3, 2025: CISA VINCE case VU#396042 officially opened
• April 9-16, 2025: Extensive technical discussions with affected vendors
• June 18, 2025: CISA case closure decision (dismissed as "understood risk")
• July 1, 2025: Public disclosure following extended coordination period

Vendor Responses and Technical Disagreements

IDScan.net (Joshua Sheetz, CISO/VP Engineering)

Initial Response: "After investigating this, it looks like you are just spoofing the barcode data. This is a common standard."

Technical Position:

• Claimed their parser "just reads data" and isn't responsible for validation
• Argued that impossible values (524-year-old individuals) are acceptable in a "parser"
• Dismissed implementation-specific vulnerabilities as AAMVA standard limitations
• Contradicted their own marketing claims about "hundreds of algorithmic security checks"

Marketing vs. Reality Gap:

• VeriScan website promises "Fake ID Detection / ID Authentication"
• Claims to "catch fake IDs" and perform "security checks"
• Technical analysis revealed minimal validation beyond format compliance

TokenWorks Response

• Acknowledged the issue as a "DMV implementation problem"
• Downplayed vendor responsibility for cryptographic validation
• No remediation timeline provided

CISA Decision (June 18, 2025)

Final Determination: "CISA has decided that this is not a vulnerability as it is an understood risk in the AAMVA DL Standard."

Technical Analysis of CISA's Position: This decision appears to conflate standard limitations with implementation-specific vulnerabilities. The research documented distinct technical issues:

1. Multi-Layered Vulnerability Classification:

   • Layer 1: AAMVA standard cryptographic deficiencies (acknowledged)
   • Layer 2: Implementation-specific validation failures (dismissed by CISA)
   • Layer 3: Marketing claims vs. actual security capabilities (not addressed)

2. Implementation-Specific Issues Documented:

   • CWE-20 (Improper Input Validation): Accepting physiologically impossible values
   • CWE-345 (Insufficient Verification of Data Authenticity): No cryptographic checks
   • CWE-770 (Allocation of Resources Without Limits): No rate limiting
   • CWE-841 (Improper Enforcement of Behavioral Workflow): No pattern detection

Proof of Concept Validation Evidence

Missouri ShowMeID Government Application Bypass

Missouri ShowMeID bypass evidence

gpg --verify signatures/show_me_id/img.png.asc scan_proof/show_me_id/img.png

Impact: Complete bypass of Missouri's official government ID verification application, demonstrating systemic vulnerabilities in state-level identity verification systems.

VeriScan Enterprise Validation Bypasses

California License Validation Failures

gpg --verify signatures/veriscan/california/andrew_before.png.asc scan_proof/veriscan/california/andrew_before.png
gpg --verify signatures/veriscan/california/andrew_after.png.asc scan_proof/veriscan/california/andrew_after.png

Arizona License Validation Bypasses

gpg --verify signatures/veriscan/arizona/unanimous.png.asc scan_proof/veriscan/arizona/unanimous.png
gpg --verify signatures/veriscan/arizona/unanimous_1.png.asc scan_proof/veriscan/arizona/unanimous_1.png

Florida License Validation Failure

gpg --verify signatures/veriscan/florida/wendy_synthesized.png.asc scan_proof/veriscan/florida/wendy_synthesized.png