Default Admin Password Let Researchers Unlock and Start Cars

Researchers been able to take over customer accounts at two car brands. They then demonstrated how they could remotely unlock and start a test car after finding an administration console on the brands' login servers still protected by its default password.

Security researchers Shubham Shah and Sam Curry detailed the work in a write-up published November 7. Customer logins for both brands ran on OpenIDM, identity management software from ForgeRock, now part of Ping Identity. The brands were not named, at the automakers' request.

The researchers reported the flaw to the two automakers and pointed to ForgeRock's hardening guidance to remove or protect the console before deployment.

Test Car Unlocked and Started From a Hijacked Account

In early 2026, the researchers bypassed the web application firewall (WAF) in front of the login servers and found the console still accepted its documented default credentials. From there they ran their own code on the identity servers and changed the email address and password on a test account.

Logging in as that customer through the normal app, they unlocked and started the test car with its owner present. The session also exposed the vehicle's location and telemetry.

The researchers wrote that they could have created a session for any customer account on the affected deployments. Changing an account's login details also left the owner's existing app session active, and the researchers could divert the app's notifications away from the owner's phone.

Both automakers fixed the issue about two hours after the flaw was reported and rotated affected credentials, according to the write-up.

Read more on default passwords in connected systems: CISA, FBI Urge Action to Protect Industrial Refrigeration Networks

Australian Systems Exposed Through Hardcoded Credentials

In a companion post, Shah described a separate chain against one of the automaker's Australian systems, researched in July 2026.

The chain could start from a car's number plate. Hardcoded administrator credentials, a WAF bypass and a misconfigured multi-factor authentication (MFA) step then allowed account takeover and remote unlocking.

The exposed data included customers' names, phone numbers and password hashes. Together, the write-ups covered vehicles in Australia, the US and Canada. The researchers wrote that they tested only on cars they owned or had permission to use.

Shah's post does not say when the Australian findings were reported or whether they have been fixed. Neither post reports malicious use or says whether the researchers checked for it.

Shah's post also does not mention when the Australian findings were reported or whether they have been fixed. Neither post reports malicious use or says whether the researchers checked for it.

Ping Identity was contacted for comment but did not respond by the time of publication.