Researchers Shubham Shah and Sam Curry found default credentials on ForgeRock OpenIDM administration consoles at two unnamed automakers, letting them take over customer accounts and unlock and start a test car. Both automakers fixed those deployments about two hours after disclosure and rotated affected credentials, their report says.
After bypassing the web application firewall (WAF), the researchers ran code on the identity servers and changed a test customer’s email and password. They then signed in through the ordinary car app; its vehicle permissions let the new login unlock and start the car. The session also exposed location and telemetry, while the owner’s existing app session remained active.
A separate chain against one automaker’s Australian system used hardcoded administrator credentials and a misconfigured multi-factor authentication (MFA) step to take over accounts and unlock vehicles. Shah’s post does not say whether that system was fixed. For automakers whose identity servers issue sessions to vehicle-control apps, those servers’ administration consoles sit inside the control boundary, and the Australian system’s current exposure remains unsettled.