Security Researchers Expose Critical Vulnerabilities Allowing Remote Vehicle Hijacking

In a stark reminder of the security risks inherent in the rapidly digitizing automotive industry, security researchers Shubham Shah and Sam Curry have detailed a series of alarming vulnerabilities that allowed them to remotely take over customer accounts at two major car brands. By exploiting fundamental oversight in the configuration of identity management software, the researchers were able to demonstrate the capability to remotely unlock, track, and start vehicles, raising significant questions about the security posture of modern connected cars.

The findings, published in a comprehensive technical write-up on November 7, underscore the danger of "default" configurations in industrial-grade software. The researchers discovered that the login servers for the two affected automakers were running on OpenIDM, a robust identity management platform developed by ForgeRock—a company now integrated into Ping Identity. Despite the sophistication of the platform, the automakers had failed to follow essential hardening guidelines, leaving administrative consoles exposed and protected only by their factory-set default credentials.

Out of respect for the sensitive nature of the discovery and the time required for remediation, the researchers have withheld the names of the specific automakers involved. However, the implications of their findings are broad, affecting vehicle fleets across the United States, Canada, and Australia. The researchers promptly disclosed these flaws to the affected manufacturers, highlighting the necessity of removing or securing administrative interfaces before deploying such systems in a live, internet-facing environment.

Test Car Unlocked and Started From a Hijacked Account

The vulnerability discovery process, which took place in early 2026, revealed a concerning level of access. The researchers began their investigation by probing the web application firewall (WAF) protecting the automakers’ login servers. After successfully bypassing these security perimeters, they discovered that the underlying administrative consoles remained active and, more importantly, were still configured to accept the software’s documented default credentials.

With administrative access secured, the researchers were able to execute their own custom code directly on the identity servers. This level of access effectively granted them control over the entire user database. To prove the severity of the exploit, they targeted a test account, successfully altering its associated email address and password. By then logging into the standard consumer-facing mobile application using these modified credentials, they were able to gain full control over the associated vehicle.

During a demonstration conducted with the vehicle’s owner present, the researchers successfully unlocked the doors and started the engine remotely. Beyond basic vehicle control, the compromised session provided real-time access to sensitive vehicle telemetry and precise GPS location data. The researchers noted that this exploit was not limited to a single user; rather, they could have theoretically generated a valid session for any customer account hosted on the affected deployments. Furthermore, by manipulating account login details, they could effectively lock out the actual owner while diverting the vehicle’s push notifications to their own devices, ensuring the malicious activity remained undetected by the victim.

The response from the manufacturers was swift once the vulnerability was reported. According to the researchers, both automakers implemented a fix within approximately two hours of the initial disclosure. This remediation process included closing the exposed administrative consoles and rotating the compromised credentials to prevent further unauthorized access. The incident highlights a broader industry concern regarding the reliance on connected systems and the persistent danger of default passwords in an era where software-defined vehicles are increasingly the norm.

Australian Systems Exposed Through Hardcoded Credentials

The scope of the researchers’ findings extended well beyond the initial discovery in North America. In a separate, detailed analysis published in a companion post, Shubham Shah described a more complex, multi-stage attack chain targeting one of the same automaker’s systems in Australia, which was investigated in July 2026.

This second exploit chain demonstrated that the security flaws were not isolated to a single configuration error. The attack path began with a simple input: the vehicle’s number plate. By leveraging this information, the researchers were able to navigate through a series of misconfigurations, including the use of hardcoded administrator credentials embedded within the system architecture. Complemented by another WAF bypass and a significantly flawed multi-factor authentication (MFA) implementation, the researchers were once again able to achieve a full account takeover, granting them the ability to unlock vehicles remotely.

The depth of the data exposure in the Australian systems was particularly alarming. The researchers found that they could access a wide array of sensitive customer information, including full names, personal phone numbers, and encrypted password hashes. While these findings paint a picture of widespread vulnerability, it is important to note that the researchers limited their testing strictly to vehicles they owned or for which they had obtained explicit permission to use.

The timeline for the remediation of the Australian systems remains unclear, as neither the researcher’s follow-up post nor the official reports explicitly state when these findings were disclosed or whether they have been fully resolved by the manufacturer. Furthermore, neither report indicates whether these vulnerabilities had been identified and exploited by malicious actors prior to the researchers’ investigation, nor do they provide evidence that any unauthorized entities were aware of these specific security gaps.

The technical community continues to grapple with the reality that as vehicles become more connected, they essentially function as rolling computers, inheriting the security challenges of the IT world. The reliance on complex third-party software, such as ForgeRock’s identity management solutions, necessitates a rigorous approach to security integration. When manufacturers fail to properly harden these systems, the consequences can transcend digital privacy concerns, entering the realm of physical safety.

Ping Identity, the parent organization now overseeing the ForgeRock platform, was contacted for comment regarding the security researchers’ findings and the general recommendations for hardening their software in automotive deployments. However, the company did not provide a response by the time of publication. As automakers continue to race toward a fully connected future, the pressure on manufacturers to prioritize "security by design" has never been greater, as the potential for unauthorized access remains a critical risk to both consumer data and vehicle safety.