WASHINGTON (CNN) -- A congressional investigation has exposed gaping holes in security eight years after the September 11 terrorist attacks, a government report says.

An investigator used fake documents to obtain a U.S. passport, a congressional report says.

An investigator used a false identification to obtain a U.S. passport and then used the passport to get an airline boarding pass and go through an airport security checkpoint, according to the Government Accountability Office.

The GAO, the investigative arm of Congress, said its undercover investigator conducted four tests of the passport issuance system and "easily" obtained passports every time.

Individuals with "even minimal counterfeiting capabilities" can obtain genuine U.S. passports, which can be used to travel overseas, open bank accounts and prove U.S. citizenship, the GAO report says.

In the "most egregious" case, it says, the investigator used the Social Security number of a man who died in 1965 to obtain a Social Security card. In another case, he used the Social Security number of a 5-year-old child and obtained a passport, even though his counterfeit documents and application indicated he was 53 years old.

"A U.S. passport is a key to virtually anywhere in the world," said Sen. John Kyl, R-Arizona. "It is very troubling that in the years since the September 11 attacks someone could use fraudulent documents to obtain a U.S. passport."

Kyl and Sen. Dianne Feinstein, D-California, both members of the Senate Judiciary Committee's subcommittee on terrorism, requested the test.

To perform the test, the GAO designed four scenarios. In each, an investigator simulated the actions of a malicious person involved in identity theft, then created fake documents using "off-the-shelf, commercially available hardware, software, and materials."

The investigator used the counterfeit documents to obtain a genuine Washington, D.C., identification card.

For three of the tests, the undercover investigator submitted passport applications and supporting materials at U.S. Postal Service locations that accept passport applications.

For the remaining test, it submitted the application and materials to the State Department's regional passport office in Washington.

"State and USPS employees did not identify our documents as counterfeit in any of our four tests," the GAO report says. The State Department "issued a genuine U.S. passport in each case."

"All four passports were issued to the same GAO investigator, under four different names," it says. The tests occurred between July and December of last year.

A State Department spokesman was not immediately available for comment.

But the GAO said in the report that State Department officials "agreed that our findings expose a major vulnerability" in the passport issuance process. State Department officials said the department's ability to verify the information submitted "is hampered by limitations to its information-sharing and data access with other agencies at the federal and state levels."

Some agencies won't share information because of privacy concerns, or because the State Department is not a law enforcement agency.

Also, the department, like other government agencies, has difficulty verifying birth certificates because there are thousands of acceptable formats for them.

All About GAO • Transportation Security • U.S. Department of State • Information Privacy