The login systems behind two car brands’ mobile apps could be taken over completely, two security researchers found, allowing them to access any customer’s account and, for an owner with a connected car, unlock the doors and start the engine.
Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an administrator console that still used its default password.
They tested the full attack only on their own and consenting owners’ cars in the United States, in February 2026, and both systems were fixed about two hours after they reported the problem.
Shubham Shah and Sam Curry published their work late last week. They had started with the apps: both brands signed customers in through the same platform, which runs in two parts: one for login and one, called OpenIDM, that holds customer records.
OpenIDM comes with a built-in administrator console powered by the Apache Felix tool. ForgeRock’s own hardening guide tells operators to remove this console or protect it before going live because it stores its own password separately from the rest of the system. On these servers, it was still there and still used the documented default: the word admin for both the username and the password.
The console was blocked from the open internet, but the edge that guards the site and the Java software behind it read the same web address differently. By adding encoded slashes and extra characters, the researchers made the edge treat the request as a harmless static file while the server treated it as the path to the console, and the default password did the rest. The full method is in their technical analysis.
Inside the console, the researchers used a built-in scheduler to run small scripts that execute their own code on the identity server. That gave them a command prompt on the machine that holds the customer records for both brands’ logins.
The records sat behind the same block as the console, but the researchers’ code reached them from inside the server. They changed a target account’s email address and password, signed in as that customer through the normal app, and received the same access tokens the real app uses.
Those tokens were the keys to the car. Using the account’s own vehicle commands, the researchers unlocked the doors and started the engine of a test car, with the owner standing next to it, then stopped the engine and locked it again.
The researchers were careful about what they had shown. They reported being able to open a session for any customer account on the affected servers, but they ran the vehicle commands only on cars they owned or were allowed to use. They said they “tested the complete chain only with US accounts and vehicles.”
Shubham Shah published a second attack on the Australian systems behind the same brands. There, the way in was different: admin credentials for the identity server had been left in the app’s code, intended for a test setup. He set out the full Australia chain in a separate post.
With both attacks together, the researchers said, they could send unlock and engine-start commands to the brands’ cars in Australia, the United States, and Canada. That second post does not give a date for when the Australian systems were fixed.
The attack left little for an owner to notice. Changing the email and password did not log the owner out of their app, and the researchers could direct the account’s alerts to their own phone, keeping them off the owner’s phone.
The researchers put the real email address back after the test. Neither write-up says whether anyone else found or used the path before it was closed.
What Identity Teams Should Check
The brands’ mistake was in how they ran ForgeRock, not a new bug in the product, so there is no CVE, the public ID that tracks a flaw, and no vendor advisory to follow. The console and its default password have been documented for years, and the maker’s production hardening guide already tells operators to remove the console or change its password before going live.
For teams running the same identity software, now sold as PingIDM, two checks matter:
- Look for the Apache Felix console at /system/console, and remove it or change its default password.
- Do not count on edge or WAF path rules to hide an admin page. A path the edge and the server read differently can slip past the rules, as it did here.
The two researchers have a long record of this kind of work, usually breaking into the web systems behind the apps rather than the cars themselves. They have shown remote access to vehicles from Honda, Kia, and Subaru, among others.
A Subaru flaw they reported exposed owners’ accounts and their cars through that carmaker’s connected-car service, and a broader 16-brand study in 2023 found the same kind of web weakness across much of the industry.
