The 28-year-old was one of the most wanted men in the world, featuring in numerous propaganda videos for the Islamic State (IS) group in Syria.
The group's top leaders chose him in June to organise attacks in France, Italy and Spain, according to an article in Intelligence Online, which monitors jihadist networks.
"It has to be said, Schengen has as many holes as a sieve," said a former high official with France's DGSE intelligence agency, who requested anonymity.
Schengen is the free-movement zone of 26 European countries, which until recently had no border controls, and has been seen as one of the EU's most treasured achievements.
"That such a guy was able to wander around like that without anyone noticing, that shows there's a problem -- a big one," said the former official.
In the IS online magazine Dabiq, Abaaoud boasted of his escape back to Syria after police raided a jihadist cell in Belgium this year.
"My name and picture were all over the news yet I was able to stay in their homeland, plan operations against them and leave safely when doing so became necessary," he wrote.
"I was even stopped by an officer who contemplated me so as to compare me to the picture, but he let me go, as he did not see the resemblance."
One of the attackers who died during Friday's carnage in the Bataclan concert hall, 28-year-old French citizen Samy Amimour, also escaped detection.
Amimour was charged in France in October 2012 with being part of a terrorist conspiracy over an abortive plan to travel to Yemen.
Yet he was able to jump bail and sneak out of the country the following year to Syria.
A subsequent international arrest warrant did not stop him re-entering France undetected to take part in Friday's attacks.
Signup to our newsletter and follow us on Facebook and Twitter!
"Contrary to what we think, it's very easy to enter and leave the European Union without being spotted," said criminologist Christophe Naudin, a specialist in fake documents.
"We should think of Schengen's entry controls as pretty much non-existent."
- Switching identities -
Naudin said the most probable scenario was that the jihadists used the passports of people who look similar -- which he called the "look-alike" method.
"(Someone doing this) will pass the border controls without a problem," said Naudin.
The first thing the jihadist groups do when they receive new recruits -- the estimate is that nearly 30,000 foreign fighters have joined their ranks -- is confiscate their documents.
"They don't touch the photo -- it's the new user that does his best to resemble the picture," said Naudin.
"He might grow his beard and trim it in the same way. And, more than 99 times out of 100, it will work. There's no need to tamper with passports."
IS also has plenty of opportunities to buy top-quality fake documents on the black market. Its control of vast swathes of Iraq and Syria also means it has widespread access to unused passports.
"When Abaaoud says he has done return trips to Europe and Syria, I believe him," said Naudin.
"He's not the only one. The only solution is to employ biometric checks at the European level. All airports, all borders. But we're a long way from that."
The massacre of November 13 in Paris has already bolstered politicians across the continent who have been calling for a tightening of the borders and increased cooperation between intelligence services.
French Interior Minister Bernard Cazeneuve had harsh words for his European partners on Thursday, saying not one EU country had provided information on Abaaoud's return.
"It is urgent that Europe wakes up, organises itself and defends itself against the terrorist threat," said Cazeneuve, repeating calls to share passenger airline data, a request that has been held for years over privacy concerns.