A Factory-Default ‘admin’ Password Let Researchers Hijack Two Car Brands’ App Accounts, Then Unlock and Start a Test Car
Researchers Shubham Shah and Sam Curry say an identity-server admin console left on its documented admin/admin default let them take over customer app accounts for two car brands and send unlock and engine-start commands. No new bug and no CVE were involved, only a skipped hardening step.
No zero-day was needed. Two well-known security researchers say the login back end behind two car brands’ mobile apps still had an administrator console running on its out-of-the-box username and password. From there, they could take over any customer’s account on those servers and, with the owner’s permission, open the doors of a connected car and start its engine.
The account below is based on reporting by The Hacker News, which summarized the technical write-ups that Shubham Shah and Sam Curry published late last week. The brands themselves are not named in that report.
The chain, one step at a time
- A shared identity platform. Both apps signed customers in through ForgeRock, an identity product now part of Ping Identity. It runs in two pieces: one handles logins, and a second component, OpenIDM, stores the customer records.
- A console that should not have been there. OpenIDM ships with an administrator console built on the Apache Felix tool. ForgeRock’s production hardening guide tells operators to remove it or lock it down before going live, partly because it keeps its own separate password. On these servers it was still present, and the username and password were both still “admin.”
- A front door that read addresses differently. The console was supposed to be unreachable from the internet. But the edge layer guarding the site and the Java software behind it interpreted the same web address in different ways. By adding encoded slashes and extra characters, the researchers got the edge to treat their request as a harmless static file while the server routed it to the console.
- Code execution on the identity server. Once inside, they used the console’s built-in scheduler to run small scripts, which gave them a command prompt on the machine holding customer login records for both brands.
- Taking over an account. From that foothold they changed a target account’s email address and password, signed in through the normal app and received the same access tokens the genuine app uses.
- Moving the car. Those tokens carried the account’s vehicle permissions. With the owner standing beside a test car, the researchers unlocked it and started the engine, then shut it off and locked it again. They say they ran the full chain only on US accounts and on vehicles they owned or had permission to use, in February 2026, and that both systems were fixed roughly two hours after they reported the problem.
- A second path in Australia. Shah described a separate attack on the Australian systems behind the same brands, where administrator credentials for the identity server, meant for a test setup, had been left inside the app’s code. Combined, the researchers say, the two paths could reach cars in Australia, the United States and Canada. That second write-up does not say when the Australian systems were fixed.
Why an owner would never have noticed
Changing the account’s email and password did not sign the real owner out of the app, and the researchers could route the account’s alerts to their own phone. They restored the original email address after testing. Neither write-up says whether anyone else found or used this path before it was closed.
No patch to install, because nothing was broken in the product
This was a deployment mistake, not a new software flaw, so there is no CVE and no vendor advisory. For anyone running the same identity software, now sold as PingIDM, the report highlights two checks: look for the Apache Felix console at /system/console and either remove it or change its default password, and do not rely on edge or web-application-firewall path rules alone to hide an administrative page.
What this means for your company
Cars make the headline, but the lesson applies to every small business with a back office online. Default credentials on admin consoles, appliances, printers, cameras, NAS boxes and cloud tools are among the cheapest ways in, and an attacker does not need a stolen password when the vendor already published one. A firewall rule or a hidden URL is a speed bump, not a lock. Keep an inventory of every management interface you own, change or disable default accounts on day one, put admin pages behind a VPN or an allow-list plus multi-factor sign-in, and test from the outside whether those pages are truly unreachable. Also check that a password or email change on a customer account triggers a notice to the old address and ends existing sessions.
Not sure which admin panels in your environment are still on factory settings or reachable from the internet? We can help you find them before someone else does. Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
