Researchers use default password to unlock and start cars via automaker apps

How the attack worked

Two security researchers, Shubham Shah and Sam Curry, discovered that the login systems behind two car brands' mobile apps could be taken over using a default administrator password. Both brands used ForgeRock, an identity platform, to manage customer sign-ins. The researchers found that the administrator console for this system was still online and protected only by the default username and password: both set to "admin". This is a well-known default that should be changed before any system goes live.

The console was not directly exposed to the open internet, but the researchers found a way around this. By crafting web requests with encoded slashes and extra characters, they made the system's edge protection treat the request as harmless, while the server itself saw it as a request for the admin console. Once inside, the default password gave them full control.

Inside the console, they used a built-in scheduler to run their own code on the server. This let them access and change customer records, including email addresses and passwords. They changed a test account's details, signed in as that user, and received the same access tokens the real app uses to control a car.

What was taken

The researchers were able to access customer records and take over accounts. With full access, they could send commands to unlock car doors and start engines. In their tests, they only used this ability on their own cars or those of consenting owners. The attack did not log the real owner out or alert them, as the researchers could redirect notifications to their own devices.

The response

The researchers reported the issue in February 2026. Both affected systems in the United States were fixed about two hours after the report. The researchers also found a similar issue in Australia, where admin credentials had been left in the app's code. This allowed access to the identity server for Australian, US, and Canadian accounts. The timeline for the Australian fix was not given.

What you should do

For anyone running ForgeRock or similar identity platforms, the key lesson is to remove or secure any default admin consoles before going live. Do not rely on edge protections or web application firewalls alone, as attackers may find ways to bypass them. Always change default passwords and follow the vendor's hardening guides.

Has this happened before?

The same researchers have previously found similar weaknesses in other car brands, including Honda, Kia, and Subaru. In 2023, a study found web security issues across 16 car brands, showing that this is a widespread problem in the automotive industry.

Read the full report at The Hacker News↗ (opens in a new tab)