Two security researchers recently discovered a significant vulnerability in the login systems of two automotive brands’ mobile applications. By exploiting this flaw, they were able to access customer accounts and, for connected vehicles, remotely unlock the doors and start the engine.
Security Flaw in Identity Platform
The vulnerability was found in apps that used ForgeRock, an identity platform now part of Ping Identity. Researchers Shubham Shah and Sam Curry identified a default password on an administrator console that allowed them complete control over the system. This console was part of ForgeRock’s OpenIDM, used to manage customer records.
The researchers tested their findings in February 2026 on cars they either owned or had permission to access in the United States. Within hours of reporting their findings, both systems were patched. Their work, published last week, highlighted the ease with which they bypassed security measures.
Technical Details of the Attack
The researchers noted that the administrator console was powered by Apache Felix, and the default password was still unchanged. Although the console wasn’t directly accessible from the internet, they manipulated web requests to bypass security measures. This allowed them to gain command-level access to the server holding customer records.
Once inside, they changed the email and password of a target account, allowing them to sign in and receive access tokens identical to those used by legitimate app users. With these tokens, they could control vehicle functions such as unlocking doors and starting the engine.
Preventive Measures for Identity Teams
The issue stemmed from improper management of the ForgeRock system rather than a new software bug. The researchers emphasized the importance of following the production hardening guide, which advises changing default passwords and removing the console before deployment.
For organizations using similar identity software, it’s critical to scan for the Apache Felix console at /system/console and either remove it or change its default password. Relying on edge or WAF path rules for security can be inadequate, as demonstrated by this breach.
Shubham Shah also highlighted a separate vulnerability in the Australian systems of these brands, which were accessed through admin credentials left in the app’s code. This underscores the global reach and potential impact of such vulnerabilities.
The researchers’ work serves as a cautionary tale for automakers and tech companies, emphasizing the need for robust security practices. Their findings reveal the potential risks of neglecting basic security measures, such as changing default passwords and securing administrative consoles.
