Security researchers Shubham Shah and Sam Curry have disclosed how misconfigured identity-management systems used by two unnamed automakers could have allowed unauthorised access to customer accounts and remote control of connected vehicles. Published on 7 November 2026, their research details attack chains that could enable an attacker to take over customer accounts and, where vehicles were connected to the affected services, issue commands to unlock doors and start engines. Both automakers used ForgeRock, an identity platform now part of Ping Identity, to manage customer authentication and account information through their mobile applications. The researchers said they identified weaknesses in the companies’ production environments and reported the findings to the affected organisations, which fixed the US systems within approximately two hours and rotated the affected credentials. They deliberately withheld the automakers’ names, explaining that they did not want the disclosure to divert resources towards managing public attention rather than addressing the security issues.
In the US investigation, the researchers found that the OpenIDM component of ForgeRock included an Apache Felix administrative console that remained accessible through a path manipulation technique and used its documented default login credentials, with both the username and password set to “admin”. Although the console was intended to be blocked from direct internet access, the researchers found that the security layer protecting the website and the Java software processing requests interpreted specially formatted URLs differently. By using encoded path separators and additional characters, they were able to reach the administrative interface despite the existing restrictions. Once inside, they used the console’s built-in configuration and scheduling capabilities to execute code on the identity server. This provided access to the system managing customer records and allowed them to modify account email addresses and passwords. They then signed into the automakers’ regular mobile applications using the altered credentials and obtained the access tokens used by the applications to communicate with connected vehicles. The researchers demonstrated that these tokens could be used to unlock and start a test vehicle, with the owner present and aware of the test, before returning the vehicle to its original locked state.
A separate investigation by Shah uncovered another attack path affecting the automakers’ Australian systems. In this case, administrator credentials intended for a test environment had been embedded in the application’s code and could be used against the production identity infrastructure. The researchers also identified weaknesses in the way requests were handled by the security controls protecting the OpenIDM services, enabling them to access customer information, modify account credentials and bypass parts of the authentication process, including multi-factor authentication. After obtaining valid application access tokens, they demonstrated that remote vehicle commands could be issued through the connected-car service. According to the researchers, combining the US and Australian findings showed that the affected systems could potentially expose vehicles in the United States, Canada and Australia to unauthorised remote commands. However, they clarified that the complete attack chain was tested only with US accounts and vehicles in the first investigation, while the Australian findings were demonstrated separately. They also reported that changing an account’s email address and password did not automatically sign the legitimate owner out of the application, and that account alerts could be redirected to another phone during the testing. The researchers restored the original email addresses after completing their tests. Neither report established whether an unauthorised party had exploited the weaknesses before they were fixed.
The researchers stressed that the findings resulted from security misconfigurations in the automakers’ deployments rather than a newly discovered software vulnerability in ForgeRock itself. Consequently, the reports do not identify a new CVE or describe a vendor-issued security advisory for this specific incident. Ping Identity’s official PingIDM security documentation has long advised administrators to remove or protect the Apache Felix web console before deploying the identity platform in production. The guidance also explains that the console uses authentication separate from the main identity-management system and documents the default username and password settings. Organisations using PingIDM should therefore review whether the Felix web console is present at /system/console, remove it where it is not required or replace its default credentials, and avoid relying solely on web application firewall or edge security rules to protect administrative interfaces. The findings highlight the importance of securing identity infrastructure that connects customer accounts with sensitive services such as connected vehicles.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
