Science & Tech · Cybersecurity · 6 hrs ago
Default admin password exposed two automakers’ connected-car systems
Two security researchers found a way into login systems used by two automakers’ apps.
The systems relied on ForgeRock, an identity platform, and exposed an administrator console that still used the default username and password, “admin.”
By exploiting how the server handled specially formatted web addresses, the researchers reached customer records and took control of accounts.
They used account access to unlock and start a test car through the app’s normal vehicle commands, with the owner present.
They said they tested vehicle commands only on cars they owned or had permission to use, and tested the full attack chain with US accounts and vehicles.
Both affected US systems were fixed about two hours after they were reported.
A separate attack on the brands’ Australian systems used administrator credentials left in app code; the researchers said the combined methods could affect cars in Australia, the US and Canada.
Two security researchers found that a default administrator password exposed the login systems used by two automakers’ mobile apps.
The flaw let them access customer accounts and, on connected cars, unlock doors and start engines.
The researchers tested vehicle commands only on cars they owned or had permission to use.
They reported the problem, and both affected systems were fixed about two hours later.
A separate attack on the brands’ Australian systems used administrator credentials left in an app’s code.
- Who
- Security researchers Shubham Shah and Sam Curry found the flaws affecting two automakers’ systems.
- What
- Default or exposed administrator credentials let the researchers access customer accounts and use vehicle commands to unlock and start connected cars.
- When
- The researchers tested the full US attack in February 2026. The article was published on November 9, 2026.
- Where
- The affected systems served customers in the United States, Australia and Canada.
- Why
- The US servers retained a documented default administrator password; credentials for the Australian identity server had been left in the app’s code.
This story does not have two clearly opposing sides.
The researchers tested the full attack on their own and consenting owners’ cars in the United States.
Both affected systems were fixed.
Shubham Shah and Sam Curry published their work, according to the article.
- Automakers affected
- Two
- Default login
- admin:admin
- Researchers
- Shubham Shah and Sam Curry
- US testing
- February 2026
- Time to fix
- About two hours after reporting
- Affected markets cited
- United States, Australia and Canada
1 source
What people are saying
tested the complete chain only with US accounts and vehicles