Researchers take over two car apps using default admin credentials

Security researchers Shubham Shah and Sam Curry took over the sign-in systems for two car brands’ mobile apps using admin:admin on ForgeRock OpenIDM administrator consoles, validating the chain with American accounts and vehicles in February 2026 and disclosing the flaw on Nov. 7.

Customers signed in through ForgeRock Access Management, and OpenIDM held customer records for both apps. The consoles still relied on the documented default of admin as both username and password, and OpenIDM runs its built-in administrative console through the Apache Felix tool.

The researchers did not exploit a new product bug. A web application firewall blocked direct requests to administrative services and repeated queries triggered IP address blocks, so the researchers connected by calling the system directly from localhost. They sent encoded paths that edge systems treated as static files, while the servers interpreted the same paths as console requests. Inside, they ran code through a built-in scheduler and won a command prompt, then inserted a small Java component into the running service; the researchers’ technical report says access to the server exposed administrative credentials that allowed local requests to customer records.

Researchers modified a test account’s e-mail address and password, logged in as that customer, and took the same access tokens the mobile app uses. The change left the owner’s original session active and did not log the owner out. The researchers rerouted the account’s notifications to their own device so the owner’s phone never received them, then restored the real e-mail address after the test, but the newly created tokens remained valid.

With those tokens, the researchers gained remote control equal to the owner’s companion app for connected vehicles. They could lock and unlock doors, start and stop engines, trigger horns and hazard lights, and follow the vehicles’ locations. The commands traveled through the official app’s own routes.

The exposed data included more than location. A name, email address, phone number, or internal ID was enough to locate and access an account on the vulnerable servers. Researchers could see identification numbers, where the vehicle was, how far it had traveled, its power range, tire pressure, and subscription details. Vehicle telemetry included location and tire pressure, along with door and window status, health warnings, alerts, subscription status, and identification details.

Other accessible fields included an internal generation value, remote capabilities, subscription state, the ownership role, model details, and vehicle records.

They discovered and validated the issue, then alerted the automakers’ product security teams in early 2026. The researchers withheld the carmakers’ names to keep from distracting their security teams during a busy time. The published accounts do not say whether anyone else discovered or exploited the route before closure, and the findings came from controlled security research, not a reported criminal campaign.

Testing was restricted to the researchers’ own cars and consenting owners’ vehicles in the United States during February 2026. “tested the complete chain only with US accounts and vehicles.” Shubham Shah and Sam Curry said this.

Shah and Curry have demonstrated remote access to vehicles from Honda, Kia, and Subaru, including a Subaru flaw that exposed owners’ accounts and cars through the carmaker’s connected-car service. Previous research on Kia remote access and Subaru STARLINK security flaws came before these findings. A wider study covering 16 brands during 2023 uncovered the same web flaw across large parts of the auto sector.

Shah also described a separate Australian case where admin credentials for the identity server were left inside an app’s code for a test setup. The researchers said combining both approaches let them send unlock and engine-start commands to vehicles in Australia, the United States, and Canada, though the Australian post gives no date for when those systems were fixed.

The error was in how the brands operated ForgeRock, not in a product defect, so there is no CVE and no vendor advisory to follow. Ping Identity’s production hardening guide says to take down or shield the Felix console and change its default credentials, and its guidance warns that logging in through the console is not the same as logging in through IDM. The case shows that hiding admin pages behind a firewall does not replace securing the identity service itself.

Groups running this identity software should look for the Apache Felix console at /system/console and either delete it or change the default password. They should not depend on edge or WAF path rules to hide an administrative page, because varying path interpretations can bypass those rules. Both carmakers fixed the problem within roughly two hours of receiving the report, and the researchers removed their code and changed the affected credentials afterward.