Security researchers Shubham Shah and Sam Curry have disclosed a series of vulnerabilities that allowed them to remotely unlock and start vehicles by compromising the identity management infrastructure of two unnamed automotive brands. The researchers detailed their findings in separate reports published in early November 2026, noting that the flaws affected customer accounts across the United States, Canada, and Australia.
The primary attack vector involved an administrative console for the identity management software OpenIDM, which is developed by ForgeRock, a company now part of Ping Identity. The researchers discovered that these consoles remained protected by documented default credentials, which had not been changed during the deployment process. By bypassing the web application firewall (WAF) protecting the login servers, the researchers were able to gain unauthorized access to the administrative backend.
Once inside the management console, the researchers demonstrated the ability to execute arbitrary code on the identity servers. This level of access allowed them to modify the email addresses and passwords associated with customer accounts. By hijacking a test account, the researchers successfully logged into the official mobile application, which enabled them to unlock and start a test vehicle while the owner was present. The session also granted access to sensitive vehicle data, including real-time location and telemetry information.
The researchers noted that this exploit could theoretically be applied to any customer account within the affected deployments. Furthermore, the attack allowed for the suppression of notifications sent to the vehicle owners, as the researchers could divert alerts away from the owners' mobile devices while maintaining an active session.
In a separate investigation conducted in July 2026, Shah identified a distinct attack chain targeting one of the automakers' systems in Australia. This method allowed for account takeover starting from a vehicle's license plate number. By combining hardcoded administrator credentials with a WAF bypass and a misconfigured multi-factor authentication (MFA) process, the researchers were able to access customer records, including names, phone numbers, and password hashes.
The affected automakers confirmed the issues and implemented fixes shortly after they were reported. According to the researchers, the primary vulnerability involving the default admin credentials was remediated within approximately two hours of notification, and the companies rotated the compromised credentials. The researchers emphasized that these vulnerabilities stemmed from a failure to follow established hardening guidance provided by the software vendor, which explicitly advises removing or securing the console before moving to a production environment.
The researchers stated that their testing was strictly limited to vehicles they owned or had explicit permission to access. There is currently no evidence to suggest that these vulnerabilities were discovered or exploited by malicious actors prior to the researchers' disclosure. Ping Identity, the parent company of the software provider, did not provide a comment regarding the findings.
