Skip to content
Default Credentials Exploited to Unlock Cars via ForgeRock Vulnerability

Default Credentials Exploited to Unlock Cars via ForgeRock Vulnerability

First seen 9 Nov 2026, 18:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 18:39 UTC
  • •Default 'admin:admin' credentials allowed unauthorized access to customer accounts.
  • •Researchers exploited ForgeRock servers to unlock and start connected cars remotely.
  • •Vulnerability was patched within two hours after being reported.

Security researchers discovered that default 'admin:admin' credentials on ForgeRock servers allowed unauthorized access to customer accounts for two automakers. This vulnerability enabled them to unlock and start vehicles remotely. The researchers, Shubham Shah and Sam Curry, conducted their tests on consenting owners' cars in February 2026, and reported their findings on November 7, 2026. The attack exploited a misconfiguration in the identity platform's administrator console, which was still using default credentials. The flaw also exposed vehicle locations and allowed remote engine commands. Both automakers patched the vulnerability within two hours of the report. The researchers emphasized that they only tested their method on vehicles they owned or had permission to access.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 14h ago How this analysis works

Timeline

2026-02-01
Research conducted on car apps
Researchers tested the vulnerability on consenting owners' cars in the U.S., confirming the exploit's effectiveness.
Feeds.Feedburner
2026-11-07
Vulnerability disclosed
Shubham Shah and Sam Curry published their findings about the exploit affecting two automakers.
Cybersecuritynews
2026-11-07
Vulnerability patched
Both automakers fixed the vulnerability within two hours of the disclosure.
Feeds.Feedburner

More articles in this cluster (2)

Following this threat?

Track ForgeRock in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 4

Common questions

What systems were affected?
The vulnerability affected the mobile apps of two automakers using ForgeRock's identity platform.
How was the vulnerability exploited?
Researchers exploited default 'admin:admin' credentials in the ForgeRock administrator console to gain unauthorized access.
What actions should affected users take?
Users should ensure their vehicle apps are updated to the latest version to mitigate any potential risks.