Security researchers have uncovered a critical vulnerability in ForgeRock servers that allowed unauthorized access to connected vehicles. By exploiting default credentials, hackers could remotely unlock cars, highlighting severe security flaws in the system.
Discovery of the Vulnerability
The vulnerability was initially discovered in early 2026 and publicly disclosed on November 7. Researchers found that the exploit provided access to vehicle locations and enabled remote engine commands, posing significant security risks. This revelation was part of a controlled research project and not linked to any criminal activities. The affected automakers, who remain unnamed, swiftly addressed the issue by updating their credentials within two hours of receiving the report.
Although the automakers’ identity systems were used across various regions, the researchers conducted their tests solely on U.S. accounts and vehicles, demonstrating the potential for complete account takeover and vehicle access.
Technical Exploitation of ForgeRock
The investigation began with an analysis of Android applications used by vehicle owners. These apps utilized ForgeRock Access Management for user sessions and OpenIDM for customer records. During their research, security experts traced an email validation process that led them to administrative services, including the Apache Felix Web Console operating with OpenIDM.
A web application firewall initially blocked direct access to these services. However, by using specially encoded paths, researchers made requests appear as static files, allowing them access to the hidden management interface. The default credentials ‘admin:admin’ were still active, enabling unauthorized entry.
Implications for Vehicle Security
Through access to the Felix ConfigMgr interface, researchers set up an OpenIDM scheduled task to execute Groovy code. This step installed a Java component within the running service, establishing a command endpoint and confirming remote code execution in the production identity process.
Once inside, administrative credentials were exposed, permitting local requests to customer records. Researchers altered a test account’s email and password, acquired verification codes, and completed the login process. These actions enabled token exchanges that granted access to vehicle APIs, exposing information about vehicles, locations, and remote control capabilities.
Despite restoring the original email, the tokens remained valid. This incident follows previous studies on Kia and Subaru’s systems, emphasizing the need for improved security protocols.
Ping Identity’s hardening guide for production environments already advises securing the Felix console and altering default credentials. This case illustrates the necessity of robust security measures beyond merely blocking administrative URLs, particularly in systems managing customer identities and vehicle access.
Integrating threat intelligence from numerous Security Operations Centers (SOCs) can provide critical context for preventing such incidents swiftly.
