Researchers describe chain that could unlock connected cars from a major automaker

Shubham Shah, working with Sam Curry, published research on exposed admin tools, leaked ForgeRock credentials, a WAF bypass and an MFA bypass that could let an attacker mint app tokens and send remote commands to connected vehicles in Australia, the United States and Canada. The researchers said they tested the techniques only on vehicles they owned or had permission to access.

Shubham Shah, a security researcher who focuses on internet-facing web applications and infrastructure, published an account on Nov. 7, 2026, of a collaboration with Sam Curry to examine the connected-car systems of a major automaker. Shah has owned several vehicles from the brand and bought a new SUV in 2023, giving him access to its connected-car platform. He and Curry examined the systems in July 2026 and found a chain of weaknesses that, in their testing, could let an attacker control vehicles in Australia, the United States and Canada. Shah said they used the techniques only on vehicles they owned or had permission to access.

The work began with the automaker's mobile app. Shah decompiled the Android application and traced its API calls to a telematics platform. Most parts of the consumer app called back to that platform, and additional reconnaissance turned up an admin tool on a public subdomain. The tool's login page shipped a large JavaScript bundle, which Shah and Curry reviewed. The bundle exposed capabilities that let employees interact with customer accounts and production vehicles with few restrictions, along with hardcoded API keys. Those capabilities included account lookups by email address, feature provisioning, adding secondary users and generating remote access codes. They did not include direct remote control of a vehicle.

The automaker uses ForgeRock's OpenAM and OpenIDM software for identity management. Shah and Curry found an OpenIDM instance and, in a vendor JavaScript bundle, admin credentials meant for a staging environment but working in production. The instance sat behind a web application firewall that blocked requests to sensitive OpenIDM paths. The researchers spent days on path-traversal techniques and, with help from a large language model, found a variant that bypassed both the WAF and OpenIDM's routing checks. They also found an OpenIDM endpoint that did not trigger the WAF and returned password hashes, PIN code hashes, mobile push tokens and personal information.

Shah said the same general approach did not work unchanged in the United States and Canada because those environments had stronger protections. Curry published a separate account of the additional work required there. Combined, the two writeups describe remote commands such as unlocking and starting engines for vehicles in Australia, the United States and Canada.

Shah's post does not state whether the automaker has patched the issues or when. It does show how a connected-car platform can combine several ordinary weaknesses: an exposed admin interface, secrets in client-side code, incomplete WAF coverage, an identity API that leaks sensitive data and an authentication flow that can be bypassed. For other automakers and connected-device companies, the lesson is to keep admin tools off the public internet, remove secrets from browser code, enforce MFA on every path, segment identity services and treat WAF rules as a supplement rather than a control.

Shah's full account is at shubs.io .

Source : unlocking any car from X brand in most of the world , by Shubham Shah , shubs , Nov 7, 2026