Ethical Hacking News
Security researchers have uncovered a severe vulnerability in the ForgeRock identity platform, which has the potential to expose automakers to potential car hacking. The researchers discovered that the login systems behind two car brands' mobile apps could be taken over completely, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. While the attack left little for an owner to notice, the researchers' findings highlight the importance of securing identity platforms and the need for automakers to take immediate action to protect their customers' data.
Security researchers Shubham Shah and Sam Curry discovered a severe vulnerability in the ForgeRock identity platform that could expose automakers to car hacking. The vulnerability was in the platform's built-in administrator console, which used the default password "admin" for both the username and password. The researchers exploited the vulnerability by using encoded slashes and extra characters to access the console, which allowed them to unlock and start cars. The attack left little for an owner to notice, and the researchers could direct the account's alerts to their own phone, keeping them off the owner's phone. The vulnerability highlights the importance of teams running the same identity software taking immediate action to secure their systems.
The world of cybersecurity is replete with countless examples of how a single vulnerability can have far-reaching consequences. Recently, security researchers Shubham Shah and Sam Curry have uncovered a severe vulnerability in the ForgeRock identity platform, which has the potential to expose automakers to potential car hacking. The researchers discovered that the login systems behind two car brands' mobile apps could be taken over completely, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine.
The ForgeRock identity platform is an identity platform that was previously part of Ping Identity, and it is used by several prominent car brands. The platform is composed of two parts: one for login and one called OpenIDM, which holds customer records. OpenIDM comes with a built-in administrator console powered by the Apache Felix tool. ForgeRock's own hardening guide tells operators to remove this console or protect it before going live, as it stores its own password separately from the rest of the system. However, in this case, the console was still present on the servers, and it still used the documented default password, which is the word "admin" for both the username and the password.
The researchers exploited this vulnerability by using a technique called "encoded slashes and extra characters" to make the edge that guards the site and the Java software behind it read the same web address differently. By adding these encoded slashes and extra characters, the researchers made the edge treat the request as a harmless static file while the server treated it as the path to the console, and the default password did the rest. Inside the console, the researchers used a built-in scheduler to run small scripts that execute their own code on the identity server, giving them a command prompt on the machine that holds the customer records for both brands' logins.
The records sat behind the same block as the console, but the researchers' code reached them from inside the server. They changed a target account's email address and password, signed in as that customer through the normal app, and received the same access tokens the real app uses. These tokens were the keys to the car, and using the account's own vehicle commands, the researchers unlocked the doors and started the engine of a test car, with the owner standing next to it, then stopped the engine and locked it again.
It is worth noting that the researchers were careful about what they had shown, and they only tested the complete chain on US accounts and vehicles. However, they also published a second attack on the Australian systems behind the same brands, where the way in was different: admin credentials for the identity server had been left in the app's code, intended for a test setup. This attack left little for an owner to notice, as changing the email and password did not log the owner out of their app, and the researchers could direct the account's alerts to their own phone, keeping them off the owner's phone.
The attack on the Australian systems also allowed the researchers to send unlock and engine-start commands to the brands' cars in Australia, the United States, and Canada. The researchers put the real email address back after the test, and neither write-up says whether anyone else found or used the path before it was closed. The brands' mistake was in how they ran ForgeRock, not a new bug in the product, so there is no CVE, the public ID that tracks a flaw, and no vendor advisory to follow.
The console and its default password have been documented for years, and the maker's production hardening guide already tells operators to remove the console or change its password before going live. For teams running the same identity software, now sold as PingIDM, two checks matter: Look for the Apache Felix console at /system/console, and remove it or change its default password. Do not count on edge or WAF path rules to hide an admin page. A path the edge and the server read differently can slip past the rules, as it did here.
Shubham Shah and Sam Curry are two security researchers who have a long record of this kind of work, usually breaking into the web systems behind the apps rather than the cars themselves. They have shown remote access to vehicles from Honda, Kia, and Subaru, among others. In this case, they exposed owners' accounts and their cars through the carmaker's connected-car service.
A broader 16-brand study in 2023 found the same kind of web weakness across much of the industry. The attack left little for an owner to notice, and the researchers could direct the account's alerts to their own phone, keeping them off the owner's phone. The researchers put the real email address back after the test, and neither write-up says whether anyone else found or used the path before it was closed.
In conclusion, the recent vulnerability in the ForgeRock identity platform has exposed automakers to potential car hacking. The researchers exploited a vulnerability in the platform's built-in administrator console, which was still using the documented default password. The attack left little for an owner to notice, and the researchers could direct the account's alerts to their own phone, keeping them off the owner's phone. It is essential for teams running the same identity software to take immediate action to secure their systems.
Related Information:
https://www.ethicalhackingnews.com/articles/Severe-Vulnerability-in-ForgeRock-Identity-Platform-Exposes-Automakers-to-Potential-Car-Hacking-ehn.shtml
https://thehackernews.com/2026/11/default-adminadmin-server-password.html
Published: Mon Nov 9 06:37:49 2026 by llama3.2 3B Q4_K_M
