The password admin:admin opened the door to the identity servers of two automakers. From there, researchers Shubham Shah and Sam Curry were able to take over customer accounts and send remote commands to connected cars, including unlocking the doors and starting the engine, among other actions described in their tests.
The access did not rely on a new vulnerability in the vehicle or a weak password chosen by a driver. The brands' Android apps used ForgeRock to manage logins, and the researchers found an Apache Felix administration console exposed on the OpenIDM servers with its default credentials. They combined this with techniques to bypass the firewall's path filters to reach the console.
The brands were not identified. According to The Hacker News, the researchers tested the full chain only with US accounts and vehicles, in February 2026, and both affected systems were fixed about two hours after they reported the issue. The research also included a separate attack path against the same brands' Australian systems.
Two attack paths through ForgeRock
Shah, co-founder of Assetnote, and Curry began by reviewing the mobile apps. Both brands authenticated their customers through ForgeRock, an identity platform that, according to PrivacyAffairs, Thoma Bravo combined with Ping Identity in 2023. In the architecture they examined, one component handled logins and another, OpenIDM, stored customer records.
The US finding centered on Apache Felix, an administration console integrated into OpenIDM. ForgeRock's hardening guide recommends removing the console or securing it before putting the system into production: its password is stored separately from the rest of the configuration. The console remained available on the brands' servers and accepted the default combination, with admin as both the username and password.
The console was not directly open to the internet. However, the web application firewall (WAF) in front of the service and the server's Java software interpreted certain URLs differently. By including encoded slashes and additional characters, the researchers got the WAF to treat the request as if it were asking for a harmless static file, while the server routed it to the Felix console. The Register describes the mechanism as a combination of path confusion and WAF filter bypass.
Once inside, Shah and Curry used Felix's task scheduler to run a small Groovy script. The task gave them shell access to the identity server. From there, they could query local administrative APIs and read or modify account data. PrivacyAffairs adds that the server environment also contained the IDM administrator's username and password.
The Australian route was different. Shah found OpenIDM administrative credentials hard-coded in a JavaScript file distributed with the automaker's Android app. They were supposed to be for a test environment, but also worked against production and the real customer directory. In that region, the researchers bypassed the WAF through path traversal flaws and were able to call internal APIs without having to execute remote code, which they did need to complete the US chain.
The Australian attack could start with a vehicle's license plate number. According to iTnews, the researchers used public license plate checkers to obtain the vehicle identification number (VIN), then queried internal APIs. One exposed response included password and PIN hashes, mobile notification tokens, phone numbers, and full names. The Register also notes that the queries could retrieve owners' personal information and email addresses.
From a compromised account to car commands
In Australia, the data obtained allowed the researchers to target specific accounts. Shah and Curry could reset a user's password, bypass multifactor authentication using an OAuth password grant, and generate an app token. With that token, they could send commands to the vehicle using features already available in the mobile app.
In the US chain, access to Felix gave the researchers a way to reach OpenIDM records from inside the server. They changed the email address and password of a target account, signed in with the new credentials through the app's normal flow, and received the same access tokens used by the legitimate app.
Those tokens provided access to the commands associated with the account. In a test car, with its owner standing beside it, the researchers unlocked the doors and started the engine; they then turned it off and locked the vehicle again. The Register also mentions commands to sound the horn and flash the headlights. PrivacyAffairs lists location and telemetry functions, as well as locking, unlocking, and starting or stopping the engine.
The researchers limited physical testing to cars they owned or whose owners had given permission. Shah and Curry said they could open a session for any customer account on the affected servers, but did not issue vehicle commands to cars belonging to others without authorization. In the words of their post, “tested the complete chain only with US accounts and vehicles”.
The account takeover could be difficult for an owner to detect. Changing the email address and password did not close the session already open in the customer's app. In addition, the researchers could redirect account alerts to their own phone and away from the owner's device. PrivacyAffairs explains that the app accepted a device identifier and notification token supplied by the phone.
To demonstrate the process on a test account, the researchers changed the email address to one they controlled and set a new password. The six-digit verification code arrived in that inbox. The account displayed its associated vehicles, their VINs, models, and subscriptions, along with the remote commands available to the customer.
“Not sure how many other people would find this chain!”
— Shubham Shah, co-founder of Assetnote
After the test, the researchers restored the real email address. None of the cited reports says whether anyone else had previously found or used these access points, or indicates how many accounts or vehicles could have been affected.
US systems were harder to breach
The researchers described the North American operation's defenses as more robust than Australia's. Shah told iTnews that accessing the US systems was “definitely a lot harder”. He told The Register that the US attack “required a lot more work” because the automaker had spent more time securing the OpenIDM environments in the US, Canada, and Europe.
The difference was partly in the WAF. In Australia, the filter was weaker, and the researchers did not need remote code execution to get around it. In the US, they had to chain path confusion with access to the Felix console and task execution on the server. The protection did not prevent the attack, but it raised the amount of work needed to complete the intrusion.
The published details do not reveal the brands. The Register reports that some enthusiasts identified the partially blurred car in a demonstration video as a Toyota, based on the shape of its side mirror and the sound of it unlocking. They also speculated that the automakers could be Toyota and its luxury brand Lexus. A Toyota Motor Corporation spokesperson neither confirmed nor denied those claims.
Curry explained that he and Shah respected the companies' request to remain anonymous because they did not want them diverting resources in response to the disclosure. The Register quotes his explanation: “Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure.”
The flaw was in the server configuration
The issue was not attributed to a new ForgeRock flaw. The use of the console and its default password were documented, and the product's hardening recommendations already said it should be removed or secured before production. For this reason, The Hacker News notes that there is no associated CVE or vendor security advisory to follow.
The automakers fixed the affected systems about two hours after receiving the report, according to The Hacker News and The Register. iTnews adds that there was no reward or recognition through a bug bounty program. PrivacyAffairs says the exposed credentials were changed. Shah's Australian post does not give a specific date when those systems were fixed.
For teams administering this software, The Hacker News highlights two specific checks: look for the Apache Felix console at /system/console and remove it or change its default password; and do not rely solely on WAF path rules to hide administrative pages. The issue arose precisely because the filter and the server interpreted a request differently.
Shah and Curry had previously investigated connected services from automakers. The Hacker News recalls their work on Honda, Kia, and Subaru, as well as a 2023 investigation into web weaknesses across 16 brands. PrivacyAffairs notes another earlier case in November 2024: a vulnerability in the Subaru Starlink administrative panel allowed the pair to unlock, start, and locate cars, as well as view a year's worth of location history; Subaru fixed that issue in one day.
In this case, the identities of the two brands remain publicly unconfirmed. It has also not been disclosed whether the companies searched their logs for signs of previous access. Shah and Curry's research shows that, in these systems, a compromised account can provide access to the same remote features the app gives the owner.
Sources: The Hacker News, The Register, iTnews, PrivacyAffairs
