What happened
Security researchers Shubham Shah and Sam Curry found serious flaws in early 2026 in the server infrastructure behind two major automakers' mobile apps. The flaws allowed anyone on the internet to remotely unlock the doors of any connected car and start its engine. Both automakers patched the vulnerabilities quickly.
What was exposed
Beyond door and engine control, the flaws exposed vehicle location, mileage, fuel and range, door states and customers' personal information. The researchers did not name the affected automakers, but the vehicle shown in the second firm's demo video points to Toyota.
Where the mistakes were
The problems were not in ForgeRock's authentication services but in how the automakers implemented them:
- An internet-reachable "test harness" login page
- A JavaScript bundle that should have been stripped of cruft but contained the backend's entire functionality and hard-coded admin credentials
- The ability to mint an access token for any user with that information
- Reaching a customer's email through public data such as license plate and VIN
Why it matters
The researchers suspect the web application firewall (WAF) was likely placed to mask weaknesses underneath. The incident shows how critical basic security practices are in the backends of connected vehicles.
