Security researchers Shubham Shah and Sam Curry demonstrated how default credentials on ForgeRock identity servers, now part of Ping Identity, allowed complete takeover of customer accounts belonging to two major automakers. The flaw enabled attackers to unlock doors and start engines on connected vehicles through the manufacturers' mobile applications.
Both automakers used the same ForgeRock deployment consisting of a login service and OpenIDM for storing customer records. The Apache Felix web console, which ships with OpenIDM, remained accessible and still used the documented default username and password of admin:admin. Although the console was not directly reachable from the internet, the researchers bypassed the edge protection by sending requests with encoded slashes that the web application firewall interpreted differently from the backend Java server.
Once inside the console, the researchers executed scripts via the built-in scheduler to obtain a command shell on the identity server. This access allowed them to modify any customer's email address and password, authenticate through the normal mobile application, and obtain valid access tokens. These tokens provided the same vehicle control capabilities available to legitimate owners, including remote unlock and engine start commands.
The researchers conducted full end-to-end testing only on vehicles they owned or for which they had explicit owner consent, limiting operations to accounts and cars located in the United States. They also identified a separate attack vector affecting Australian systems, where administrator credentials had been left in the application source code from a test deployment. Combined, the two attack paths could affect vehicles in the United States, Canada, and Australia.
Minimal Owner Visibility and Rapid Remediation
The attack produced almost no visible signs for vehicle owners. Changing the account email and password did not terminate existing mobile app sessions, and the researchers could redirect account notifications to their own devices. After testing, they restored the original email addresses.
Both manufacturers fixed the exposed consoles within roughly two hours of receiving the researchers' reports. No CVE identifier was issued because the issue stemmed from improper deployment configuration rather than a product vulnerability in ForgeRock or Ping Identity software.
Recommendations for Identity Management Teams
Organizations running PingIDM or legacy ForgeRock deployments should verify that the Apache Felix console at /system/console is either removed or protected with a strong password. Reliance on web application firewall path filtering alone is insufficient, as demonstrated by the researchers' bypass technique.
