Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars Swati KhandelwalNov 09, 2026Vulnerability / Automotive Security The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an administrator console that still used its default password. They tested the full attack only on their own and consenting owners' cars in the United States, in February 2026, and both systems were fixed about two hours after they reported the problem. Shubham Shah and Sam Curry published their work late last week. They had started with the apps: both brands signed customers in through the same platform, which runs in two parts: one for login and one, called OpenIDM, that holds customer records. OpenIDM comes with a built-in administrator console powered by the Apache Felix tool. ForgeRock's own hardening guide tells operators to remove this console or protect it before going live because it stores its own password separately from the rest of the system. On these servers, it was still there and still used the documented default: the word admin for both the username and the password. The console was blocked from the open internet, but the edge that guards the site and the Java software behind it read the same web address differently. By adding encoded slashes and extra characters, the researchers made the edge treat the request as a harmless static file while the server treated it as the path to the console, and the default password did the rest. The full method is in their technical analysis. Inside the console, the researchers used a built-in scheduler to run small scripts that execute their own code on the identity server. That gave them a command prompt on the machine that holds the customer records for both brands' logins. The records sat behind the same block as the console, but the researchers' code reached them from inside the server. They changed a target account's email address and password, signed in as that customer through the normal app, and received the same access tokens the real app uses. Those tokens were the keys to the car. Using the account's own vehicle commands, the researchers unlocked the doors and started the engine of a test car, with the owner standing next to it, then stopped the engine and locked it again. The researchers were careful about what they had shown. They reported being able to open a session for any customer account on the affected servers, but they ran the vehicle commands only on cars they owned or were allowed to use. They said they "tested the complete chain only with US accounts and vehicles." Shubham Shah published a second attack on the Australian systems behind the same brands. There, the way in was different: admin credentials for the identity server had been left in the app's code, intended for a test setup. He set out the full Australia chain in a separate post. With both attacks together, the researchers said, they could send unlock and engine-start commands to the brands' cars in Australia, the United States, and Canada. That second post does not give a date for when the Australian systems were fixed. The attack left little for an owner to notice. Changing the email and password did not log the owner out of their app, and the researchers could direct the account's alerts to their own phone, keeping them off the owner's phone. The researchers put the real email address back after the test. Neither write-up says whether anyone else found or used the path before it was closed. The brands' mistake was in how they ran ForgeRock, not a new bug in the product, so there is no CVE, the public ID that tracks a flaw, and no vendor advisory to follow. The console and its default password have been documented for years, and the maker's production hardening guide already tells operators to remove the console or change its password before going live. For teams running the same identity software, now sold as PingIDM, two checks matter: Look for the Apache Felix console at /system/console, and remove it or change its default password. Do not count on edge or WAF path rules to hide an admin page. A path the edge and the server read differently can slip past the rules, as it did here. The two researchers have a long record of this kind of work, usually breaking into the web systems behind the apps rather than the cars themselves. They have shown remote access to vehicles from Honda, Kia, and Subaru, among others. A Subaru flaw they reported exposed owners' accounts and their cars through that carmaker's connected-car service, and a broader 16-brand study in 2023 found the same kind of web weakness across much of the industry. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. API Security, Automotive Security, Identity Security, Vulnerability, Web Security Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens AI-Generated Fake Login Pages Are Making Account Takeovers Easier ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Reserve My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk