Skip to content
Default Credentials Expose Two Automakers to Remote Vehicle Control

Default Credentials Expose Two Automakers to Remote Vehicle Control

First seen 9 Nov 2026, 01:51 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 20:10 UTC
  • •Researchers exploited default 'admin' credentials in ForgeRock's identity platform.
  • •The vulnerability allowed remote access to customer vehicles, including unlocking and starting engines.
  • •Both automakers patched the issue within two hours of disclosure.

In early 2026, researchers Shubham Shah and Sam Curry discovered a vulnerability in the ForgeRock identity platform used by two unnamed automakers, allowing them to exploit default 'admin' credentials. This breach enabled them to remotely unlock, start, and track connected vehicles, accessing sensitive customer data like VINs and locations. The researchers reported the flaw, prompting both automakers to patch the issue within two hours. The vulnerability affected customers in the US, Australia, and Canada, with the researchers confirming they tested the exploit only on vehicles they owned or had permission to access. The attack vector involved bypassing a web application firewall (WAF) and utilizing hardcoded credentials found in the mobile app's JavaScript. The automakers opted not to disclose their identities to avoid diverting resources during a busy security period.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 12h ago How this analysis works

Timeline

2026-07-01
Research began on connected car systems
Shubham Shah and Sam Curry started examining the security of a major automaker's connected car systems.
Samcurry
2026-11-07
Vulnerability reported
Shah and Curry disclosed the vulnerability to the automakers, leading to immediate action.
Samcurry
2026-11-09
Flaw patched
Both automakers fixed the vulnerability within two hours of being notified by the researchers.
Cybernews

More articles in this cluster (6)

Following this threat?

Track ForgeRock in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 4

Common questions

Which automakers were affected?
The automakers have not been named to avoid distracting their security teams.
What was the attack method?
The researchers exploited default 'admin' credentials found in the mobile app's JavaScript.
How quickly was the vulnerability patched?
Both automakers patched the vulnerability within two hours of being notified.