Default admin:admin and hardcoded credentials on ForgeRock OpenIDM let researchers hijack two automakers' apps and remotely unlock and start cars

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 10/11/2026 09:15 · coletado 10/11 10:01

   Default Credentials on ForgeRock OpenIDM Let Researchers Hijack Accounts and Remotely Unlock Cars at Two Automakers

   ler a análise desta fonte ocultar

   Researchers Shubham Shah and Sam Curry took over customer accounts at two unnamed automakers after finding an administration console on the identity login servers still protected by its default password (infosecurity-magazine.com). The login servers ran ForgeRock OpenIDM, now part of Ping Identity (infosecurity-magazine.com; thehackernews.com). Using the console, the researchers ran their own code, changed a test account's email address and password, and then unlocked and started a test car with its owner present (infosecurity-magazine.com). They say they could have opened a session for any customer account on the affected deployments, and both automakers fixed the flaw about two hours after the report (infosecurity-magazine.com; thehackernews.com). The bug is a deployment misconfiguration rather than a product flaw, so there is no CVE or vendor advisory, and neither write-up reports malicious use (thehackernews.com; infosecurity-magazine.com).

   Technical Details

   • Entry point: the researchers got past the web application firewall in front of the login servers. Encoded slashes and extra characters made the edge treat the request as a static file while the backend routed it to the console (thehackernews.com).
   • Default credentials: the console is an Apache Felix administration console built into OpenIDM. Its documented default username and password, both 'admin', still worked (thehackernews.com).
   • Code execution: the console's built-in scheduler runs scripts, which gave the researchers a command prompt on the identity server holding customer records for both brands (thehackernews.com).
   • Account takeover: the researchers changed a target account's email address and password, signed in through the normal app and received the same access tokens the app uses (thehackernews.com). Changing the credentials did not sign out the owner's existing app session, and notifications could be redirected to another phone (infosecurity-magazine.com).
   • Vehicle impact: with those tokens, the researchers could unlock doors, start and stop the engine, and view location and telemetry on a test car (infosecurity-magazine.com; thehackernews.com).
   • Australian chain (separate, researched July 2026): starting from a number plate, the researchers went from plate to VIN to subscriber GUID through admin-tool APIs. They then used admin credentials for OpenIDM embedded in a vendor JavaScript bundle, a path traversal (/static%2f..%2fopenidm/) that the WAF did not cover, and a ROPC grant that skipped MFA. They then minted an app token and sent a door-unlock command (shubs.io). The exposed data included names, phone numbers and password hashes (infosecurity-magazine.com). The researchers tested only cars they owned or had permission to use (infosecurity-magazine.com; thehackernews.com).

   Remediation

   • Remove the Apache Felix console from OpenIDM deployments or change its default password. ForgeRock's own hardening guide, which Ping Identity now maintains, says to do one or the other before go-live (thehackernews.com).
   • Do not treat WAF or edge path rules as access control for admin pages. The bypass worked because the edge and the server parsed the same URL differently (thehackernews.com).
   • Rotate any credentials that were exposed, and end existing app sessions when an account's email or password changes (analyst recommendation; the automakers rotated credentials according to infosecurity-magazine.com).
   • Keep admin credentials out of client-side JavaScript and mobile apps, and enforce MFA on every token grant, including the ROPC flow (analyst recommendation; shubs.io describes the flaws).
   • The Australian fix status and reporting date are not stated in the write-ups (infosecurity-magazine.com; shubs.io). Confirm with the affected vendor before assuming it is closed.
2. gbhackers.com ↗ · pub. 10/11/2026 03:13 · coletado 10/11 04:00

   ForgeRock WAF bypass and default Felix console credentials give RCE on two automakers' identity servers and remote car control

   ler a análise desta fonte ocultar

   Researchers Shubham Shah and Sam Curry chained a path-parsing bypass of a ForgeRock WAF with the default password of an Apache Felix web console to reach code execution on production OpenIDM servers used by two unnamed automakers. From there they could take over customer accounts, mint mobile app OAuth tokens, and reach vehicle data and remote commands such as unlocking doors and starting engines. The first stage needed only the public edge and the documented default password, which is why the article calls it critical. Still, the console was a configuration weakness, the path mismatch is an interaction between components, and no CVE or vendor advisory was found in the sources opened. Both automakers reportedly fixed the chain about two hours after the report and rotated the affected credentials, and none of the sources opened report malicious exploitation, so the rating is high.

   Technical Details

   • Identity stack: Both automakers' mobile apps authenticate through ForgeRock Access Management and keep customer records in OpenIDM, and the two login flows were nearly identical (samcurry.net).
   • WAF bypass: The edge blocked direct requests to the OpenIDM and Felix admin paths and banned the requesting IP after repeated attempts. A request under a static-asset prefix, built from encoded slashes, dot segments and semicolon path parameters, passed the edge. Jetty normalised the path before servlet selection, Felix then chose its bundles plugin, and OpenIDM's CREST layer kept an extra path segment, so each component parsed the same URL differently (samcurry.net).
   • Default credentials: The Felix console accepted admin:admin and returned an inventory of 361 bundles, 343 of them active, on Felix framework 7.0.1 (samcurry.net).
   • Code execution: Through ConfigMgr the researchers created an OpenIDM scheduler job with inline Groovy that installed an OSGi servlet through the Felix ShellService, and that servlet ran a test command inside the identity process (samcurry.net).
   • Account takeover and vehicle access: Using an administrative credential pair found in the process environment, they queried and modified managed-user records, changed a test account's email and password, completed the login with a code read from an attacker-controlled inbox, and exchanged the session for mobileappsdkclient OAuth tokens. They then listed the account's VINs and sent commands such as doors-unlock (samcurry.net).

   Remediation

   • Both automakers rotated the exposed credentials and fixed the chain (samcurry.net). No ForgeRock or Ping Identity advisory, patched release or CVE was found in the sources opened.
   • Remove the Felix Web Console from production nodes or restrict it, and replace every default password, as ForgeRock's hardening guidance recommends (samcurry.net).
   • Normalise URLs the same way across the WAF, the servlet container and the application, and deny encoded slashes, dot segments and semicolon parameters on administrative prefixes.
   • Review OpenIDM scheduler and ConfigMgr factory entries for unexpected inline Groovy jobs, and check the Felix bundle inventory for unknown bundles.
   • Keep administrative APIs on internal networks, and do not ship staging or admin credentials inside client applications.

   Conflicting Reports

   • The article says both automakers fixed the chain about two hours after disclosure. The researchers' write-up says they fixed it within about two hours after the researchers reported it (samcurry.net). The researchers' account is the more precise timeline.
   • The article's headline frames the activity as hackers exploiting the flaw. The researchers' write-up describes authorized testing that was reported to the automakers' product security teams (samcurry.net).
3. theregister.com ↗ · pub. 09/11/2026 14:31 · coletado 09/11 16:00

   Researchers hijack two unnamed automakers' ForgeRock login servers to remotely unlock, start and honk connected cars

   ler a análise desta fonte ocultar

   Researchers Shubham Shah (Assetnote) and Sam Curry chained flaws in the Android apps of two unnamed automakers to send remote commands to connected cars in Australia and the United States. The entry point is the customer login platform built on ForgeRock (now part of Ping Identity), where the researchers reached the OpenIDM identity store. The Australian route used hardcoded OpenIDM admin credentials meant for staging that also worked in production, while the US route used the factory-default admin:admin login on the Apache Felix OSGi console. Both routes let them take over owner accounts, mint valid app tokens and issue commands such as unlock, engine start, headlight flash and horn. The vehicle identifier came from public licence plate lookups, and both routes needed a WAF bypass through path traversal, which lowers the bar but still requires some skill. The automakers fixed the issues about two hours after the early-2026 report (samcurry.net), and the sources reviewed name no CVE, so this is a misconfiguration exposure rather than a product bug. Criticity is high because the chain reached remote vehicle control with public technical detail, even though the affected deployments are already fixed.

   Technical Details

   • Australian route: the researchers obtained a VIN through public licence plate checkers and queried internal APIs that returned owner personal data and email addresses. Hardcoded OpenIDM admin credentials, found in the app's code and intended for staging, worked in production (samcurry.net). A path traversal bypassed the WAF, which allowed calls to the internal admin APIs and account takeover by email address (thehackernews.com).
   • US route: a path confusion bypass reached the Apache Felix admin console, where the factory default credentials gave admin rights. A scheduled task in the Felix configuration manager ran an inline Groovy script, giving shell access to the identity servers (samcurry.net).
   • Impact: the attacker could change customer credentials, sign in as the owner and mint mobile app tokens that the official route accepted. Those tokens were used to send commands to the vehicle through the telematics API. A changed password did not end the owner's existing app session, and a hijacked push token could redirect notifications (samcurry.net, privacyaffairs.com).

   Remediation

   • Operators of ForgeRock OpenIDM should remove the Felix console or restrict it before going live, as ForgeRock's own hardening guidance recommends, and should replace default credentials (thehackernews.com).
   • Remove credentials from client-side code and JavaScript bundles, and rotate any secret that was ever shipped in an app.
   • Do not rely on WAF allowlists of path prefixes. Normalise and decode paths before filtering, and test traversal variants such as encoded slashes.
   • Invalidate existing sessions and push tokens when account email or password changes, and alert owners on new device registrations.
   • Automakers and identity teams using ForgeRock should audit their own deployments for the same patterns, since the sources reviewed describe the flaws only in the two affected deployments.

   No Fix Details section is included: the fixes are in the automakers' closed production systems, and no public repository, pull request or patch release was found for these issues.

4. thehackernews.com ↗ · pub. 09/11/2026 08:27 · coletado 09/11 10:00 primeiro registro

   Default admin:admin Credentials on ForgeRock Identity Servers Let Researchers Take Over Two Automakers' Apps and Start Cars

   ler a análise desta fonte ocultar

   Two automakers' mobile-app login systems, both built on ForgeRock (now part of Ping Identity), exposed an administrator console that still accepted the default admin:admin credentials, according to researchers Shubham Shah and Sam Curry. Combined with a path-parsing mismatch between the edge filter and the Java backend, that console gave code execution on the identity server, from which the researchers reached customer records, reset a test account and obtained the access tokens that the real app uses to control the car. The full US test was limited to accounts and vehicles the researchers owned or were permitted to use, and both systems were reportedly fixed about two hours after disclosure. No CVE or vendor advisory exists, because the cause is a deployment misconfiguration rather than a product flaw. A separate Australian chain used admin credentials left in an app's code, and the researchers say that together the two chains reached unlock and engine-start commands in Australia, the US and Canada.

   Technical Details

   The researchers' own write-up describes OpenIDM as running its Java services as OSGi bundles inside Apache Felix, whose web console conventionally lives at /system/console (samcurry.net). The console was blocked from the internet, but the edge guarding the site and the Java backend interpreted the same web address differently: encoded slashes and extra characters made the edge treat the request as a static file while the server routed it to the console (thehackernews.com). The default password then granted access, and the console's built-in scheduler ran small scripts that executed the researchers' code on the identity server (thehackernews.com). From inside the server, they changed a target account's email address and password, signed in through the normal app and received the same access tokens the app uses (thehackernews.com). Those tokens drove the account's own vehicle commands for door unlock and engine start on a test car, and the owner's session was not terminated and alerts could be redirected to another phone (thehackernews.com). The Australian entry point was different: admin credentials for the identity server had been left in the app code, intended for a test setup (thehackernews.com).

   Remediation

   • Check every ForgeRock or PingIDM deployment for the Felix console at /system/console, and remove it or change its default password, as the maker's hardening guide advises (thehackernews.com).
   • Do not rely on edge or WAF path rules to hide admin pages; make the edge and the backend resolve paths the same way (thehackernews.com).
   • Rotate administrator and service credentials, and remove any credentials embedded in mobile app code (thehackernews.com).
   • Review scheduler jobs and recent changes to customer email addresses, passwords and alert destinations for activity nobody can explain.
   • The researchers say the automakers fixed the issue within about two hours and rotated the affected credentials (samcurry.net); the article gives no fix date for the Australian systems (thehackernews.com).