Your connected car just became a lot less secure, thanks to authentication failures that would make an intern developer cringe. Security researcher Eaton Zveare discovered two critical flaws in a major automaker’s dealer portal that essentially handed over the keys—literally—to anyone who knew where to look.
The vulnerabilities, disclosed in February 2025 and patched within a week, exposed over 1,000 U.S. dealerships to a nightmare scenario where hackers could remotely unlock doors, start engines, and rifle through customer financial records. All it took was manipulating some client-side code that had fewer security checks than a gas station bathroom.
The Technical Breakdown
Two simple authentication oversights created a digital master key to thousands of dealerships.
Zveare’s discovery reads like a masterclass in what not to do with web application security. Two basic authentication oversights created a digital skeleton key to the automaker’s entire dealer network. The registration API failed to verify invitation tokens, while session validation only checked identifiers without confirming user roles.
By tweaking the portal’s client-side scripts—think of it as editing a webpage’s hidden menu options—Zveare surfaced concealed registration forms and user management panels. This led to creating unauthorized dealer accounts and escalating privileges to “national admin” status, essentially becoming the digital overlord of the entire system.
Key capabilities demonstrated:
- Remote door unlocking and engine starting on enrolled vehicles
- Access to customer personal and financial information
- Vehicle ownership reassignment enabling remote control
- Dealer analytics and shipment system infiltration
- Query capabilities by VIN number or customer name
What This Means For Your Vehicle
Dealership software has become the weakest link in your car’s digital security chain.
This breach exposes a troubling reality: your car’s security often depends on enterprise software that treats authentication like an optional feature. Dealership portals have become recurring weak points in connected vehicle ecosystems, creating backdoors that bypass all the sophisticated encryption protecting your actual vehicle.
The unnamed automaker’s quick response—patching within days of disclosure—demonstrates that these flaws were fixable with proper server-side validation and role-based access controls. Yet the incident raises uncomfortable questions about how many similar vulnerabilities exist across the automotive industry’s dealer networks.
While this specific threat has been neutralized, vehicle owners should:
- Monitor their connected car accounts for unusual activity
- Minimize unnecessary data sharing with dealership-linked applications
- Keep your vehicle’s software updated
The automotive industry’s rush to connectivity has created digital attack surfaces that extend far beyond the vehicle itself, turning everyday business operations into potential security nightmares.
