Identity · 2 days ago
Researchers Shubham Shah and Sam Curry found default credentials on ForgeRock OpenIDM administration consoles at two unnamed automakers, letting them take over customer accounts and unlock and start a test car. Both automakers fixed those deployments about two hours after disclosure and rotated affected credentials, their report says.
After bypassing the web application firewall (WAF), the researchers ran code on the identity servers and changed a test customer’s email and password. They then signed in through the ordinary car app; its vehicle permissions let the new login unlock and start the car. The session also exposed location and telemetry, while the owner’s existing app session remained active.
A separate chain against one automaker’s Australian system used hardcoded administrator credentials and a misconfigured multi-factor authentication (MFA) step to take over accounts and unlock vehicles. Shah’s post does not say whether that system was fixed. For automakers whose identity servers issue sessions to vehicle-control apps, those servers’ administration consoles sit inside the control boundary, and the Australian system’s current exposure remains unsettled.
3 sources covering this story
Default Admin Password Let Researchers Unlock and Start Cars
Default admin password on automaker login servers let researchers unlock and start test cars
Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns
Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
ForgeRock misconfigurations let researchers hijack accounts at two car brands and remotely unlock and start connected vehicles.
Part of the PlainSec briefing for 2026-11-11