Two carmakers’ mobile apps were breached by researchers who discovered a glaring security oversight: the identity servers still used the default “admin:admin” credentials. Because both apps relied on ForgeRock’s identity platform—now part of Ping Identity—and specifically its OpenIDM component, the oversight allowed attackers to take over customer accounts, unlock doors, and start engines. The flaws were tested ethically in February 2026 using only consenting devices. The brands patched the vulnerabilities about two hours after being notified.
How the Exploit Worked
The apps in question use ForgeRock’s identity platform, which has two parts: one handles login, and the other is OpenIDM, where user records are stored. OpenIDM includes an administrative console built with Apache Felix. In secure setups, that console should be removed or access hardened before production launch. Here, not only was the console still present, it still used the factory-set username and password: “admin/admin.”
While the admin console wasn’t directly exposed to the public Internet, its protection was circumvented. Security researchers observed that mimicking or embedding extra slashes and odd characters in HTTP requests caused the gateway used by the system to misinterpret requests—treating them as harmless static file lookups—while the server recognized them as requests for the console. From there, using the default credentials, they gained access.
Full Attack Chain & Global Reach
Once inside the console, the researchers ran scripts to execute code on the identity server itself, gaining command-line access. They manipulated account records, changing the email and password of targeted users, then used those credentials to obtain valid access tokens through the apps. With those tokens, they sent car commands to unlock doors, start the engine, re-lock, and turn off the engine on test vehicles they owned or were authorized to use. The attack worked in the U.S. systems, and a related but separate attack was documented in Australia, with the same brands. In those cases, the test was completed by exploiting credentials embedded in the app intended for testing only.
The Australian attack chain completed the same steps to unlock and start vehicles in the region. The U.S. vulnerabilities were fixed swiftly after disclosure; the Australian systems’ remediation timeline was less clear.
Weaknesses Exposed & What Can Be Done
This issue isn’t a defect in ForgeRock’s code itself but in how operators deployed and configured it. The ForgeRock (Ping Identity) documentation has long instructed users to remove the OpenIDM console or change its password before going live. Yet, in both instances studied, that guide wasn’t followed.
There is no official vulnerability identifier (CVE) for this, and no vendor advisory has been issued. However, companies using the same platform are advised to perform two checks immediately: verify the administrative console at /system/console is removed or has its default password changed; and do not assume edge-layer or web application firewall (WAF) path rules are enough to block access—malformed requests or differently interpreted paths may bypass them.
The researchers behind this find have exposed similar weaknesses in connected-car systems before. Prior audits have revealed that vulnerabilities in login systems—rather than the vehicles themselves—often serve as the attack vector to control cars remotely. A 2023 multi-brand study showed many manufacturers share this problem.
This incident shows just how quickly a simple misconfiguration can let attackers cross trust boundaries—from web login systems to physical control of a vehicle. For automakers, identity platform operators, and security teams alike, this is a wake-up call: enforcing best practices and securing default credentials is non-negotiable. Going forward, watch whether the industry will finally make default password hardening a standard prerequisite for connected vehicle services—and whether regulators or standards bodies will hold companies accountable.
