Researchers Remotely Unlocked and Started Connected Cars at Two Automakers

Two security researchers, Shubham Shah and Sam Curry, found vulnerabilities in the connected-car backend systems of two unnamed automakers during early 2026, allowing remote unlocking of doors and engine starting on internet-connected vehicles. The issues were quickly patched, but they exposed weak security practices, including hard-coded credentials and a misconfigured multi-factor authentication flow. The researchers also found that the flaws could reveal vehicle location, mileage, fuel, range, door states, and customer personal information.

Affected vehicles and scope

The white-hat duo did not disclose the names of the impacted automakers. Shah and Curry gained access to Automaker 1's vehicles in the United States, while vehicles from Automaker 2 were susceptible to unplanned lock disengagement in Australia, the United States, and Canada. Based on visual inspection alone, the second firm may be Toyota, because the hack demonstration video appears to depict a RAV4 SUV. One of their writeups covers ForgeRock-related affairs for both companies, while Shah's article discusses specifics for Automaker 2 and its Australian connected-car infrastructure.

Both affected automakers use ForgeRock's authentication and authorization services. According to the researchers, with one small exception, the vulnerabilities stemmed from poor implementations and security practices rather than from ForgeRock itself.

How the flaws were found

Shah began by decompiling Automaker 2's Android application and finding network calls to a telematics subdomain. He quickly found an admintool location containing a TEST HARNESS page with a login prompt. The first issue was that this endpoint was reachable from the internet at large.

A second issue was a JavaScript bundle that should have been stripped of unnecessary code but instead contained code for the backend's entire functionality. That bundle also contained hard-coded API keys, which were enough to let Shah pull up customer information. After chaining requests and connecting a license plate to a VIN using publicly available information, the researchers connected that VIN to a customer and found the customer's email.

The team also found that the JavaScript bundle contained hard-coded administrator credentials, likely meant for a staging environment. Those credentials helped reveal users' password hashes, but the hashes were SHA-512, so cracking them was unfeasible. The researchers also found a pinService accessible through a Web Application Firewall and a getUser function that could retrieve users' information using email, phone, and ID.

Account takeover and vehicle commands

After spending a couple of weeks studying how ForgeRock was used, the researchers concluded that the easiest path was to mint an access token for any user. They used GPT-5.6 Sol Ultra to brute-force path names and found an unprotected path that ultimately allowed them to overwrite any user's password, partially enabling account takeover. Multi-factor authentication remained, but the Australian environment allowed users to skip MFA entirely.

With token shuffling across endpoints and the mobile app, the researchers could mint access tokens and fully impersonate any user account. They then sent an API request for the door-unlock command, and the test car promptly opened. The vulnerabilities also exposed vehicle location, mileage, fuel, range, door states, and customers' personal information.

Sources: Tom's Hardware