Follow us on Google News
Security researchers discovered vulnerabilities in the online systems of two unnamed automobile manufacturers that allowed them to take over customer accounts and remotely unlock and start connected vehicles. The weaknesses involved improperly secured identity management servers, including an administrator console protected by the default username and password, both set to “admin”.
Researchers Shubham Shah and Sam Curry demonstrated the vulnerabilities using vehicles belonging to them or consenting owners in the United States in February 2026. Both automakers reportedly fixed the affected systems within approximately two hours of receiving the researchers’ reports.
The findings revealed how weaknesses in the systems supporting connected-car mobile applications could allow unauthorised access to customer accounts and vehicle controls without directly compromising the vehicles.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Did a Default Password Expose Connected Cars?
The researchers began by examining the mobile applications used by customers of the two automakers.
Both applications relied on ForgeRock, an identity management platform now part of Ping Identity, to authenticate users and manage customer records.
The affected systems included OpenIDM, which contained customer information and an administrator console powered by Apache Felix.
Although the console was intended for administrative use, it remained accessible through a security weakness and was protected by default login credentials.
ForgeRock’s security documentation already advised organisations to remove the console or secure it before deploying the software in production environments.
The console was not directly accessible from the public internet. However, the researchers found that the security system protecting the website and the underlying application server interpreted certain web addresses differently.
By manipulating the structure of requests, they bypassed the protective restrictions and reached the administrator console.
Once inside, the default credentials allowed them to obtain administrative access.
The researchers then used a built-in scheduling function to execute code on the identity server, giving them access to systems responsible for managing customer accounts.
Researchers Demonstrate Remote Unlocking and Engine Start
After gaining access to the identity infrastructure, the researchers were able to modify customer account information, including registered email addresses and passwords.
They then signed in through the automakers’ normal mobile applications using the modified credentials.
This provided legitimate application access tokens, allowing them to use vehicle functions associated with the affected accounts.
During an authorised demonstration, the researchers remotely unlocked a connected vehicle and started its engine while the owner stood nearby.
They subsequently stopped the engine and locked the vehicle again.
The researchers said they could establish sessions for customer accounts on the affected servers, although they tested the complete vehicle-control process only on accounts and cars they owned or had permission to use.
They also found that changing account credentials did not automatically sign out the original owner. Account notifications could potentially be redirected to another phone, reducing the likelihood that the owner would immediately notice unauthorised activity.
After completing the demonstration, the researchers restored the original account information.
Shah separately documented another security weakness affecting the Australian systems of the same automakers.
In that case, administrator credentials intended for testing had been left inside application code, providing another route into the identity infrastructure.
Taken together, the researchers said the vulnerabilities could have enabled remote vehicle commands affecting connected cars in the United States, Canada and Australia.
Automakers Fix Vulnerabilities After Security Disclosure
The affected US systems were reportedly secured within approximately two hours of the researchers notifying the automakers.
The published research did not specify when the Australian vulnerabilities were fixed.
The researchers also did not identify the two automobile manufacturers.
The findings concerned insecure deployment and configuration of ForgeRock identity management software rather than a newly discovered vulnerability in the product itself.
The software’s security guidance had already warned administrators to remove or protect the Apache Felix console before operating the platform in production.
The incident demonstrated the risks associated with leaving default administrator credentials unchanged and relying on website security restrictions to protect sensitive administrative functions.
The researchers did not report evidence that criminals had previously exploited the vulnerabilities against vehicle owners.
Shah and Curry have conducted similar investigations involving connected-car platforms, including systems associated with Honda, Kia and Subaru.
Their latest findings show how weaknesses in customer authentication infrastructure can extend beyond account security, potentially exposing physical vehicle functions controlled through mobile applications.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
