Security researchers have discovered serious vulnerabilities in the digital systems used by two automobile manufacturers, exploiting default administrator credentials to gain access to customer accounts and remotely unlock vehicles and start their engines.
The investigation, conducted by security researchers Shubham Shah and Sam Curry, revealed that the mobile applications used by the two car brands relied on ForgeRock, an identity management platform now owned by Ping Identity, to authenticate customers.
The researchers discovered that an administrator console connected to the platform was still using its factory-default login credentials, with both the username and password set to “admin”.
This security oversight reportedly allowed them to gain access to systems containing customer account information and take control of accounts belonging to vehicle owners.
According to the researchers, they tested the attack on their own accounts and vehicles belonging to consenting owners in the United States in February 2026. Both affected systems were reportedly fixed approximately two hours after the vulnerabilities were disclosed to the companies.
The investigation began when the researchers examined the mobile applications and identified their reliance on ForgeRock’s identity management infrastructure. The platform uses OpenIDM, a component responsible for managing customer records.
OpenIDM includes an administrator console powered by Apache Felix. However, the researchers found that the console had not been properly secured, despite the platform’s security documentation advising administrators to remove it or change its default password before deploying the system in a production environment.
Although the console was not directly accessible from the public internet, the researchers discovered a way to bypass the restrictions.
They exploited differences in how the security layer protecting the website and the underlying Java server interpreted specially formatted web addresses. By manipulating the URL with encoded characters and additional path elements, they made the security layer interpret the request as an ordinary static file while the server processed it as a request to access the administrator console.
The default administrator credentials then provided access.
Once inside, the researchers used a built-in scheduling feature to execute scripts on the identity server, giving them command-line access to the system containing customer records.
They subsequently modified the email addresses and passwords associated with targeted customer accounts. This enabled them to log in through the companies’ regular mobile applications and obtain authentication tokens normally issued to legitimate vehicle owners.
These tokens provided access to connected-car functions.
Using the applications’ vehicle-control features, the researchers successfully unlocked the doors of a test vehicle and started its engine. They subsequently switched off the engine and locked the vehicle.
The researchers stressed that they conducted the complete attack only on vehicles they owned or had permission to access.
The investigation also revealed that the attack could be difficult for affected customers to detect. Changing an account’s email address and password did not automatically log the legitimate owner out of the mobile application.
The researchers also found that account notifications could be redirected to another phone, potentially preventing the original owner from receiving important security alerts.
In a separate investigation involving the same automobile brands’ systems in Australia, Shah identified another security weakness. This time, administrator credentials had reportedly been embedded in the mobile application’s code, where they were intended for testing purposes.
Combining the findings from the United States and Australian investigations, the researchers said they were able to issue remote unlock and engine-start commands to vehicles belonging to the affected brands in the United States, Australia and Canada.
However, the report did not specify when the Australian systems were secured.
Security Lessons for Automakers
The researchers explained that the weaknesses resulted from improper configuration and security practices rather than a newly discovered vulnerability in the ForgeRock product itself.
Consequently, the findings were not assigned a Common Vulnerabilities and Exposures (CVE) identification number, and no new vendor security advisory was issued.
The security recommendations include removing the Apache Felix administrator console from production environments or replacing its default password with a strong, unique credential.
Organisations were also advised not to rely solely on web application firewalls or internet-facing security filters to protect sensitive administrative interfaces.
The researchers noted that differences in how security gateways and backend servers interpret web addresses can create opportunities for attackers to bypass access restrictions.
Shah and Curry have previously investigated security weaknesses affecting connected vehicles from several manufacturers, including Honda, Kia and Subaru.
Their findings highlight the growing cybersecurity risks associated with modern vehicles, as manufacturers increasingly depend on internet-connected applications and cloud-based identity systems to provide remote access and control features.
The latest investigation demonstrates how a seemingly basic configuration mistake, such as leaving an administrator account with its default password, can potentially expose customer information and give unauthorised individuals control over connected vehicles.