Default admin:admin and hardcoded credentials on ForgeRock OpenIDM let researchers hijack two automakers' apps and remotely unlock and start cars
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 10/11/2026 00:04; os links antigos trazem para cá.
Fontes: theregister.com ↗ thehackernews.com ↗
Researchers Shubham Shah (Assetnote, per theregister.com) and Sam Curry chained misconfigurations in the mobile-app login platforms of two unnamed automakers. Both platforms are built on ForgeRock (now part of Ping Identity) OpenIDM. The chains let the researchers take over owner accounts, mint valid app tokens and send remote vehicle commands such as door unlock and engine start (thehackernews.com). theregister.com adds headlight flash and horn. The US route used the factory-default admin:admin login on the Apache Felix OSGi console. The Australian route used OpenIDM admin credentials hardcoded in the app. Both reportedly were fixed about two hours after disclosure (thehackernews.com, theregister.com), and the affected deployments are already fixed. No CVE or vendor advisory exists, because the cause is a deployment misconfiguration rather than a product flaw (both sources). The full US test was limited to accounts and vehicles the researchers owned or were permitted to use (thehackernews.com). theregister.com rates the criticality as high because the chain reached remote vehicle control and the technical detail is public.
Entenda a falha
A vulnerabilidade
No CVE or vendor advisory exists: the cause is a deployment misconfiguration, not a product bug. Two automakers' connected-car apps signed users in through ForgeRock OpenIDM (now PingIDM). In the US deployment the Apache Felix OSGi Web Console still used the factory default admin:admin login. In the Australian deployment, OpenIDM admin credentials meant for staging were hardcoded in the app and also worked in production. Both routes needed a WAF bypass via path traversal or path confusion. The result was admin access, takeover of any account by email address, valid app tokens and remote commands (unlock, engine start, horn, headlights). No product versions are named; the automakers fixed their deployments.
Como funciona
The app's login and account backend runs on ForgeRock OpenIDM, which holds customer records. In Australia, the researchers took a VIN from public licence plate lookups and used it to query internal APIs that returned owner data and email addresses. The admin APIs and the Felix console were blocked from the internet by an edge filter, but the edge and the Java backend read the same path differently, so encoded slashes and extra characters made the edge treat the request as a static file while the server routed it to the admin endpoint. There the hardcoded credentials or the default login were accepted. In the US chain, a scheduled task in the Felix configuration manager ran an inline Groovy script, giving shell access to the identity servers. From inside, they changed an account's email and password, signed in through the normal app, and received real tokens that the telematics API accepted for vehicle commands.
Por que é vulnerável
The root causes are misconfiguration and poor secrets handling. The Felix console was left in place with its documented default password, against ForgeRock's own hardening guide, which says to remove or protect it before go-live. Staging admin credentials were shipped in the app and not separated from production. The WAF relied on path filtering that the backend interpreted differently, so traversal and path confusion bypassed it. A changed password also did not end the owner's existing session, and alerts could be redirected to another phone. The fix was applied in the automakers' own deployments; the articles give no further detail.
Onde está
The Apache Felix web console, conventionally at /system/console, on OpenIDM servers, and the OpenIDM admin APIs behind the WAF.
Como foi descoberta
Shubham Shah (Assetnote) and Sam Curry found the issues earlier in 2026 by analysing the automakers' Android apps, and each published a separate write-up. According to Curry's disclosure timeline, they approached the automakers in early 2026 and the problems were fixed within about two hours of the report. The Hacker News says the full US test was done in February 2026. Neither write-up says whether anyone else used the path before it was closed. The automakers asked to stay anonymous and the researchers agreed; onlookers speculated they were Toyota and Lexus, and a Toyota spokesperson neither confirmed nor denied it.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The researchers demonstrated working chains against real vehicles, including a demo video of a car being unlocked, and tested the full chain only on cars they owned or were allowed to use. The chains combine default or hardcoded admin credentials with WAF bypasses to take over accounts and issue vehicle commands. The articles do not say any exploit code was released, so it is treated as private, although the technical write-ups are public. The affected deployments are already fixed, so the urgency is auditing your own ForgeRock/PingIDM deployments for the same patterns.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 00:19.
Detalhes técnicos
- US route: the Felix console, conventionally at /system/console, was blocked from the internet. The edge filter/WAF and the Java backend interpreted the same path differently, so encoded slashes and extra characters made the edge treat the request as a static file while the server routed it to the console (thehackernews.com). theregister.com describes this as a path confusion/traversal WAF bypass. The default credentials then gave admin rights. A scheduled task in the Felix configuration manager ran an inline Groovy script, giving code execution/shell access on the identity servers (theregister.com, thehackernews.com).
- Australian route: the researchers obtained a VIN through public licence plate lookups and queried internal APIs that returned owner personal data and email addresses (theregister.com). Hardcoded OpenIDM admin credentials in the app code, intended for a staging/test setup, also worked in production (theregister.com, thehackernews.com). A path traversal bypassed the WAF, allowing calls to the internal admin APIs and account takeover by email address (theregister.com).
- Impact: from inside the server the researchers changed a target account's email address and password, signed in through the normal app and received the same access tokens the real app uses (thehackernews.com). Those tokens drove vehicle commands via the telematics API on a test car (both sources). A changed password did not end the owner's existing session, and a hijacked push token could redirect alerts to another phone (both sources).
Remediação
- Check every ForgeRock/PingIDM deployment for the Felix console at /system/console. Remove or restrict it before go-live and replace default credentials, as the maker's hardening guidance advises (thehackernews.com, theregister.com).
- Do not rely on edge or WAF path-prefix rules to hide admin pages. Make the edge and backend resolve paths identically, normalise and decode paths before filtering, and test traversal variants such as encoded slashes (both sources).
- Rotate administrator and service credentials. Remove credentials from mobile app code and JavaScript bundles, and rotate any secret that was ever shipped in an app (both sources).
- Review scheduler jobs and recent changes to customer email addresses, passwords and alert destinations for unexplained activity (thehackernews.com).
- Invalidate existing sessions and push tokens when an account's email or password changes, and alert owners on new device registrations (theregister.com).
- The automakers reportedly fixed the issue within about two hours and rotated the affected credentials (thehackernews.com). The sources are truncated here, so further advice may be missing.
Relatos divergentes
- Geographic scope: thehackernews.com says the two chains together reached unlock and engine-start commands in Australia, the US and Canada. theregister.com names only Australia and the United States. Canada is therefore reported by only one source.
- Timing of the report: theregister.com places the report in early 2026 and says the fix came about two hours later. thehackernews.com says only that the fix came about two hours after disclosure, and describes it as reported rather than confirmed.
- Automaker identity: neither source names the automakers.
Linha do tempo
-
Researchers hijack two unnamed automakers' ForgeRock login servers to remotely unlock, start and honk connected cars
ler a análise desta fonte ocultar
Researchers Shubham Shah (Assetnote) and Sam Curry chained flaws in the Android apps of two unnamed automakers to send remote commands to connected cars in Australia and the United States. The entry point is the customer login platform built on ForgeRock (now part of Ping Identity), where the researchers reached the OpenIDM identity store. The Australian route used hardcoded OpenIDM admin credentials meant for staging that also worked in production, while the US route used the factory-default admin:admin login on the Apache Felix OSGi console. Both routes let them take over owner accounts, mint valid app tokens and issue commands such as unlock, engine start, headlight flash and horn. The vehicle identifier came from public licence plate lookups, and both routes needed a WAF bypass through path traversal, which lowers the bar but still requires some skill. The automakers fixed the issues about two hours after the early-2026 report (samcurry.net), and the sources reviewed name no CVE, so this is a misconfiguration exposure rather than a product bug. Criticity is high because the chain reached remote vehicle control with public technical detail, even though the affected deployments are already fixed.
Technical Details
- Australian route: the researchers obtained a VIN through public licence plate checkers and queried internal APIs that returned owner personal data and email addresses. Hardcoded OpenIDM admin credentials, found in the app's code and intended for staging, worked in production (samcurry.net). A path traversal bypassed the WAF, which allowed calls to the internal admin APIs and account takeover by email address (thehackernews.com).
- US route: a path confusion bypass reached the Apache Felix admin console, where the factory default credentials gave admin rights. A scheduled task in the Felix configuration manager ran an inline Groovy script, giving shell access to the identity servers (samcurry.net).
- Impact: the attacker could change customer credentials, sign in as the owner and mint mobile app tokens that the official route accepted. Those tokens were used to send commands to the vehicle through the telematics API. A changed password did not end the owner's existing app session, and a hijacked push token could redirect notifications (samcurry.net, privacyaffairs.com).
Remediation
- Operators of ForgeRock OpenIDM should remove the Felix console or restrict it before going live, as ForgeRock's own hardening guidance recommends, and should replace default credentials (thehackernews.com).
- Remove credentials from client-side code and JavaScript bundles, and rotate any secret that was ever shipped in an app.
- Do not rely on WAF allowlists of path prefixes. Normalise and decode paths before filtering, and test traversal variants such as encoded slashes.
- Invalidate existing sessions and push tokens when account email or password changes, and alert owners on new device registrations.
- Automakers and identity teams using ForgeRock should audit their own deployments for the same patterns, since the sources reviewed describe the flaws only in the two affected deployments.
No Fix Details section is included: the fixes are in the automakers' closed production systems, and no public repository, pull request or patch release was found for these issues.
-
Default admin:admin Credentials on ForgeRock Identity Servers Let Researchers Take Over Two Automakers' Apps and Start Cars
ler a análise desta fonte ocultar
Two automakers' mobile-app login systems, both built on ForgeRock (now part of Ping Identity), exposed an administrator console that still accepted the default admin:admin credentials, according to researchers Shubham Shah and Sam Curry. Combined with a path-parsing mismatch between the edge filter and the Java backend, that console gave code execution on the identity server, from which the researchers reached customer records, reset a test account and obtained the access tokens that the real app uses to control the car. The full US test was limited to accounts and vehicles the researchers owned or were permitted to use, and both systems were reportedly fixed about two hours after disclosure. No CVE or vendor advisory exists, because the cause is a deployment misconfiguration rather than a product flaw. A separate Australian chain used admin credentials left in an app's code, and the researchers say that together the two chains reached unlock and engine-start commands in Australia, the US and Canada.
Technical Details
The researchers' own write-up describes OpenIDM as running its Java services as OSGi bundles inside Apache Felix, whose web console conventionally lives at /system/console (samcurry.net). The console was blocked from the internet, but the edge guarding the site and the Java backend interpreted the same web address differently: encoded slashes and extra characters made the edge treat the request as a static file while the server routed it to the console (thehackernews.com). The default password then granted access, and the console's built-in scheduler ran small scripts that executed the researchers' code on the identity server (thehackernews.com). From inside the server, they changed a target account's email address and password, signed in through the normal app and received the same access tokens the app uses (thehackernews.com). Those tokens drove the account's own vehicle commands for door unlock and engine start on a test car, and the owner's session was not terminated and alerts could be redirected to another phone (thehackernews.com). The Australian entry point was different: admin credentials for the identity server had been left in the app code, intended for a test setup (thehackernews.com).
Remediation
- Check every ForgeRock or PingIDM deployment for the Felix console at /system/console, and remove it or change its default password, as the maker's hardening guide advises (thehackernews.com).
- Do not rely on edge or WAF path rules to hide admin pages; make the edge and the backend resolve paths the same way (thehackernews.com).
- Rotate administrator and service credentials, and remove any credentials embedded in mobile app code (thehackernews.com).
- Review scheduler jobs and recent changes to customer email addresses, passwords and alert destinations for activity nobody can explain.
- The researchers say the automakers fixed the issue within about two hours and rotated the affected credentials (samcurry.net); the article gives no fix date for the Australian systems (thehackernews.com).