Two carmakers breached with “admin” password: researchers unlock, start and track customers’ cars

Two carmakers protected their key login servers with the default password “admin.” Researchers took over customer accounts and could remotely unlock doors, start engines, sound horns, flash hazard lights, track vehicles, and access account data.

Hacking two automakers was almost too easy.

Security researchers Shubham Shah and Sam Curry gained the same level of remote control over connected cars as their owners do via companion apps.

“If the account had a connected vehicle, the session gave us the same remote access as the owner’s app: its location and telemetry, door lock and unlock, and remote engine start and stop,” the researchers said in a report.

The two apps exposed many details about the vehicle: VIN, location, mileage, fuel or battery range, tire pressure, door and window status, health, alerts, subscription status, and more.

Any customer account managed by the vulnerable servers could be found by name, email address, phone number, or internal ID, and accessed.

The researchers agreed not to name the two companies, saying they didn’t want to distract their security teams and “divert resources” during a busy time in cybersecurity.

How did they break in?

The researchers started by pulling apart – reverse engineering – both apps and found the same vendor underneath. Both apps managed customer accounts and logins using ForgeRock, an identity platform. The login flows were nearly identical.

Poking around the server didn’t immediately grant any access.

The app traffic pointed them to the login system’s backend, but direct access to the admin panels was blocked by the WAF (Web Application Firewall). Repeated queries resulted in the IP address being blocked.

However, they noted that altering queries’ encoding, method, and path separators produced different responses from the server. Requests for ordinary files, such as images, still reached the /static endpoint.

This allowed researchers to ultimately build a URL that appeared to the WAF filter like a static file but hid the path to the OpenIDM system’s administration panel.

“Shubham then tried the documented admin:admin default,” the report reads. “The default credentials worked.”

Getting code execution on the server was the next step. The researchers scheduled a task that ran their code on the server, which was a script to plant a backdoor – a small OSGi servlet. This allowed commands to be run on the server itself.

“The servlet inherited the working directory and execution context of the production identity process that read and modified the customer records used during both automakers’ logins,” the report details.

The firewall still blocked most outside requests, but the researchers bypassed it by calling the system directly over localhost.

Ultimately, they changed a test customer’s email and password, and logged in using a normal flow. Changing the credentials didn’t invalidate the original account owner’s app session, so the car owner wouldn’t notice anything changing.

Now the researchers could load the account’s vehicles, VINs, model information, ownership role, connected-service subscription state, remote capabilities, and an internal generation value.

They could also issue remote commands to the vehicle using the same routes as the official app.

“The API accepting a command did not prove that the car had acted on it. We refreshed its status after every request and confirmed the physical result with the owner beside the vehicle. Shubham unlocked and started it, then stopped the engine and locked it again,” the report reads.

Patched in two hours after disclosure

Shah and Curry discovered, validated the vulnerability, and reported the findings to the two carmakers’ product security teams in early 2026.

Both companies patched the problem in approximately two hours after receiving the report. The researchers’ code was removed, and the affected credentials were changed.