Sam Curry

Default 'admin:admin' Credentials in ForgeRock Servers Allow Researchers to Remotely Unlock and Start Vehicles from Two Automakers

Security researchers Shubham Shah and Sam Curry discovered that two unnamed automakers relied on ForgeRock identity platform instances with an exposed Apache Felix administrator console protected only by the default 'admin:admin' credentials. By bypassing edge protections through specially crafted URLs containing encoded slashes, the researchers gained full access to customer records stored in OpenIDM and could impersonate any user account. Once authenticated through the mobile apps, they obtained valid access tokens that enabled them to unlock doors and start engines on connected vehicles in the United States, Canada, and Australia. The researchers limited full vehicle testing to their own cars and vehicles belonging to consenting owners, reporting the issues in February 2026; both affected systems were patched within approximately two hours. A separate attack path in Australia involved hardcoded administrator credentials left in the application code from a test environment. The incidents highlight persistent misconfigurations in identity management deployments rather than novel product vulnerabilities, with no CVE assigned. The researchers have previously disclosed similar remote vehicle access issues affecting Honda, Kia, and Subaru.