Two carmakers' login systems let researchers unlock cars remotely

Two carmakers' login systems let researchers unlock cars remotely

10 November 2026: Security researchers Shubham Shah and Sam Curry gained code execution on production ForgeRock identity servers at two unnamed carmakers, which let them create a session for any customer and control that customer's connected car. Both companies fixed the flaws within about two hours of being told, and the chains depended on configuration mistakes that other users of the same software should look for.

Not yet independently verified. The carmakers are not named and we have seen no statement from either. The account rests on the researchers' own write-up and The Register's report of 9 November 2026, and no CVE number or affected version has been published. We will update this when it can be confirmed, and remove this note.

From a number plate to a remote start

The write-up, published on 7 November, describes a valid session for any customer account. Where the account had a connected vehicle, that session carried the owner's powers: location and telemetry, door lock and unlock, and remote engine start and stop. The researchers tested only US accounts and vehicles end to end, though the systems served customers in several regions.

The Register's account adds the mechanics. An Australian app chain began with vehicle identification numbers obtained from public plate checkers. Hard-coded staging administrator credentials for ForgeRock OpenIDM also worked in production, and path traversal got around the web application firewall.

The US chain used path confusion to reach the Apache Felix administration console, which still had factory default credentials. Scheduling a task that ran an inline Groovy script then gave shell access.

Mistakes in deployment rather than a product bug

No CVE number or fixed version has been published, and nothing has to be patched by owners, since the fixes were on the server side. Curry explained the anonymity in the write-up: "it's a busy time in the security world and I don't like the idea of them diverting resources."

What transfers to other buyers is the pattern. An identity platform sits in front of every customer account, so a management console or a staging secret on it has the reach of the whole customer base. Three checks follow directly from the two chains:

• confirm the Apache Felix console is unreachable from outside and does not accept default credentials
• confirm that no staging administrator credential is valid in production, and that none is embedded in a mobile app
• test whether path normalisation at the firewall matches what the application server does with the same URL

Fleet buyers have a question to ask

A fleet operator depends on a carmaker's consumer identity system for remote immobilisation and location data, usually with little sight of how it is run. The case gives procurement a concrete request: evidence of external testing of the identity tier, and the time the maker commits to for fixing a critical finding. Two hours is what these researchers saw, but only after they had found it.

We list the ForgeRock Identity Platform in our authentication software category.

Sources

• Sam Curry and Shubham Shah: Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access, 7 November 2026
• The Register: Researchers pwn automakers' Android apps to remotely unlock cars, honk horns, 9 November 2026