Researchers hijack two unnamed automakers' ForgeRock login servers to remotely unlock, start and honk connected cars
Researchers Shubham Shah (Assetnote) and Sam Curry chained flaws in the Android apps of two unnamed automakers to send remote commands to connected cars in Australia and the United States. The entry point is the customer login platform built on ForgeRock (now part of Ping Identity), where the researchers reached the OpenIDM identity store. The Australian route used hardcoded OpenIDM admin credentials meant for staging that also worked in production, while the US route used the factory-default admin:admin login on the Apache Felix OSGi console. Both routes let them take over owner accounts, mint valid app tokens and issue commands such as unlock, engine start, headlight flash and horn. The vehicle identifier came from public licence plate lookups, and both routes needed a WAF bypass through path traversal, which lowers the bar but still requires some skill. The automakers fixed the issues about two hours after the early-2026 report (samcurry.net), and the sources reviewed name no CVE, so this is a misconfiguration exposure rather than a product bug. Criticity is high because the chain reached remote vehicle control with public technical detail, even though the affected deployments are already fixed.
Entenda a falha
A vulnerabilidade
No CVE was assigned. Two exposures in the ForgeRock OpenIDM identity platform behind two unnamed automakers' connected-car apps let the researchers take over owner accounts. In the Australian deployment, hardcoded OpenIDM admin credentials meant for staging also worked in production. In the US deployment, the Apache Felix OSGi Web Console reachable through OpenIDM still had factory default credentials. Both routes required bypassing a WAF with path traversal or path confusion, and a VIN taken from public licence plate lookups. The result was admin access to the identity store, account takeover with only the owner's email address, valid app tokens, and remote commands to the car (unlock, engine start, headlights, horn). No product versions are named. The automakers fixed their deployments.
Como funciona
The app's login and account backend runs on ForgeRock OpenIDM, which stores customer identities. The researchers first got a VIN from public licence plate checkers and used it to query internal APIs that returned owner data and email addresses. A WAF is supposed to block access to the admin APIs, but path traversal (or path confusion in the US case) made requests slip past it. Behind it, the admin APIs accepted the hardcoded staging credentials, or the Felix console accepted the default login. With admin rights they could alter or view accounts, sign in as the owner and mint app tokens. The telematics API accepted those tokens as legitimate and carried out the vehicle commands.
Por que é vulnerável
The root causes are misconfiguration and weak secrets handling, not a product bug. Staging admin credentials were embedded in the app and were never separated from production. The Felix OSGi console was left exposed with its factory default login, against ForgeRock's own hardening guidance. The WAF relied on path filtering that could be bypassed with traversal and path confusion. The story also notes that a changed password did not end the owner's existing app session. The fix was applied in the automakers' own deployments, and the articles give no further detail about it.
Como foi descoberta
Shubham Shah (Assetnote) and Sam Curry found the issues by analysing the automakers' Android apps earlier in 2026, each publishing a separate blog on it. According to Curry's disclosure timeline, they reported to the affected automakers in early 2026, and the problems were fixed within about two hours of the report. The automakers asked to stay anonymous and the researchers honoured that. Onlookers speculated the cars were Toyota and Lexus, and a Toyota spokesperson neither confirmed nor denied it.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The researchers demonstrated working attack chains against real vehicles in Australia and the US, including a demo video of a car being unlocked. The chains abuse hardcoded or default admin credentials plus WAF bypasses to take over accounts and issue vehicle commands. The articles do not say any exploit code or tooling was released, so it is treated as private. The affected deployments are already fixed, so the urgency lies in auditing your own ForgeRock deployments for the same patterns.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 16:16.
Detalhes técnicos
- Australian route: the researchers obtained a VIN through public licence plate checkers and queried internal APIs that returned owner personal data and email addresses. Hardcoded OpenIDM admin credentials, found in the app's code and intended for staging, worked in production (samcurry.net). A path traversal bypassed the WAF, which allowed calls to the internal admin APIs and account takeover by email address (thehackernews.com).
- US route: a path confusion bypass reached the Apache Felix admin console, where the factory default credentials gave admin rights. A scheduled task in the Felix configuration manager ran an inline Groovy script, giving shell access to the identity servers (samcurry.net).
- Impact: the attacker could change customer credentials, sign in as the owner and mint mobile app tokens that the official route accepted. Those tokens were used to send commands to the vehicle through the telematics API. A changed password did not end the owner's existing app session, and a hijacked push token could redirect notifications (samcurry.net, privacyaffairs.com).
Remediação
- Operators of ForgeRock OpenIDM should remove the Felix console or restrict it before going live, as ForgeRock's own hardening guidance recommends, and should replace default credentials (thehackernews.com).
- Remove credentials from client-side code and JavaScript bundles, and rotate any secret that was ever shipped in an app.
- Do not rely on WAF allowlists of path prefixes. Normalise and decode paths before filtering, and test traversal variants such as encoded slashes.
- Invalidate existing sessions and push tokens when account email or password changes, and alert owners on new device registrations.
- Automakers and identity teams using ForgeRock should audit their own deployments for the same patterns, since the sources reviewed describe the flaws only in the two affected deployments.
No Fix Details section is included: the fixes are in the automakers' closed production systems, and no public repository, pull request or patch release was found for these issues.
Linha do tempo
-
Researchers hijack two unnamed automakers' ForgeRock login servers to remotely unlock, start and honk connected cars
ler a análise desta fonte ocultar
Researchers Shubham Shah (Assetnote) and Sam Curry chained flaws in the Android apps of two unnamed automakers to send remote commands to connected cars in Australia and the United States. The entry point is the customer login platform built on ForgeRock (now part of Ping Identity), where the researchers reached the OpenIDM identity store. The Australian route used hardcoded OpenIDM admin credentials meant for staging that also worked in production, while the US route used the factory-default admin:admin login on the Apache Felix OSGi console. Both routes let them take over owner accounts, mint valid app tokens and issue commands such as unlock, engine start, headlight flash and horn. The vehicle identifier came from public licence plate lookups, and both routes needed a WAF bypass through path traversal, which lowers the bar but still requires some skill. The automakers fixed the issues about two hours after the early-2026 report (samcurry.net), and the sources reviewed name no CVE, so this is a misconfiguration exposure rather than a product bug. Criticity is high because the chain reached remote vehicle control with public technical detail, even though the affected deployments are already fixed.
Technical Details
- Australian route: the researchers obtained a VIN through public licence plate checkers and queried internal APIs that returned owner personal data and email addresses. Hardcoded OpenIDM admin credentials, found in the app's code and intended for staging, worked in production (samcurry.net). A path traversal bypassed the WAF, which allowed calls to the internal admin APIs and account takeover by email address (thehackernews.com).
- US route: a path confusion bypass reached the Apache Felix admin console, where the factory default credentials gave admin rights. A scheduled task in the Felix configuration manager ran an inline Groovy script, giving shell access to the identity servers (samcurry.net).
- Impact: the attacker could change customer credentials, sign in as the owner and mint mobile app tokens that the official route accepted. Those tokens were used to send commands to the vehicle through the telematics API. A changed password did not end the owner's existing app session, and a hijacked push token could redirect notifications (samcurry.net, privacyaffairs.com).
Remediation
- Operators of ForgeRock OpenIDM should remove the Felix console or restrict it before going live, as ForgeRock's own hardening guidance recommends, and should replace default credentials (thehackernews.com).
- Remove credentials from client-side code and JavaScript bundles, and rotate any secret that was ever shipped in an app.
- Do not rely on WAF allowlists of path prefixes. Normalise and decode paths before filtering, and test traversal variants such as encoded slashes.
- Invalidate existing sessions and push tokens when account email or password changes, and alert owners on new device registrations.
- Automakers and identity teams using ForgeRock should audit their own deployments for the same patterns, since the sources reviewed describe the flaws only in the two affected deployments.
No Fix Details section is included: the fixes are in the automakers' closed production systems, and no public repository, pull request or patch release was found for these issues.