How a Default Password Unlocked Two Car Brands: The ForgeRock Misconfiguration That Could Have Affected Millions
In February 2026, security researchers Shubham Shah and Sam Curry discovered that two major automakers' connected-car mobile apps shared a common identity platform—ForgeRock (now PingIDM)—whose administrator console was left exposed with its default credentials ('admin:admin'). By exploiting a path-traversal inconsistency between the edge layer and the backend Java server, the researchers bypassed perimeter controls, authenticated to the admin console, and used a built-in script scheduler to execute arbitrary code on the identity server. This enabled full account takeover for any customer, ultimately allowing them to remotely unlock doors and start engines of connected vehicles. Both US systems were remediated within two hours of disclosure. A separate Australian attack vector leveraged hardcoded test credentials found directly in the mobile app's source code, extending the attack surface to vehicles in Australia and Canada. This incident highlights a persistent and dangerous pattern in the automotive and IoT industries: identity infrastructure misconfigurations—not novel zero-day exploits—are the primary enabler of large-scale vehicle compromise. With connected-car fleets expanding globally and identity platforms consolidating across brands, a single misconfigured shared service can expose millions of vehicles simultaneously, amplifying regulatory and safety risk.
Kill Chain
