Security researchers Shubham Shah and Sam Curry reported in early 2026 that they could unlock doors, start and stop engines, sound horns, flash hazard lights, and pull live telemetry from vehicles connected to two unnamed automakers’ remote-access platforms. They could also view vehicle location, mileage, fuel level, range, and door status for accounts they did not own, according to the researchers’ disclosure and corroborating reports. The capabilities matched what a legitimate owner sees inside the official mobile app, because the researchers were issuing commands through the same backend routes , a reminder of how apps can be secretly tracking users and exposing sensitive data through platform backends.
An Admin Console That Never Changed Its Password
The first exploit chain, targeting a North American deployment, involved path-traversal behavior that allowed the researchers to reach an administrative console behind a web application firewall. That console still accepted the credentials admin:admin, according to the researchers’ disclosure. From there, the researchers used a built-in script-execution capability to run code on identity servers and modify customer records. That access allowed them to generate valid sessions and exchange those for mobile-application authentication tokens that vehicle APIs accepted as legitimate.
Staging Credentials That Shipped to Production
The second attack chain relied on hard-coded administrator credentials found inside a client-side JavaScript bundle; those credentials were intended for a staging environment but functioned against production services. In at least one Australian deployment, MFA was misconfigured in a way that allowed researchers to bypass it, simplifying account impersonation further. Both chains trace back to the same category of failure: foundational access controls that were either never enforced or never verified after deployment.
Geographic Scope, Unnamed Brands
The researchers withheld both automakers’ identities in their public disclosure. Secondary reporting has speculated visually about one brand, but that identification is unconfirmed and should not be treated as established fact. Both companies used ForgeRock identity infrastructure; the researchers attributed the vulnerabilities to each automaker’s configuration choices, not to a defect in the ForgeRock platform itself.
Authorized Tests, No Public Evidence of Criminal Exploitation
The researchers conducted their tests on their own vehicles and those belonging to consenting owners, according to the disclosure. No public evidence identified in the available reporting shows criminal exploitation before remediation. Consumers looking to stay safe from physical-access threats should remain aware of how connected devices can expose personal data. The total number of vehicles exposed and the duration of that exposure were not established in the available reporting.
Patched in Two Hours, Questions Remaining
Both companies remediated the reported issues and rotated affected credentials within approximately two hours of disclosure, according to the researchers. As of publication, neither automaker has publicly confirmed the incident, issued a CVE, or disclosed how many customer accounts or vehicles were within reach of the flawed systems. Whether any unauthorized access occurred before the patch has not been established publicly.
When Backend Failures Become Physical Consequences
Connected-vehicle platforms convert standard identity and API failures into commands with physical consequences, a distinction that makes foundational controls more critical, not less. Default passwords, staging credentials reaching production, accessible administrative consoles, and bypassable MFA represent the kind of failures that security teams routinely audit in ordinary web applications. Automakers operating remote-command infrastructure need to treat those same controls as load-bearing. A compromised customer session here does not reset a password; it unlocks a car.
