On November 7, security researchers Shubham Shah and Sam Curry published a write-up showing they could take over customer accounts at two automakers and, from a hijacked account, remotely unlock and start a test car after finding an administration console protected by its documented default password.
How the OpenIDM administration console was discovered and abused
The customer login systems for both affected brands ran on OpenIDM, identity management software from ForgeRock, now part of Ping Identity. In early 2026 the researchers say they bypassed the web application firewall (WAF) in front of the login servers and found an administration console that still accepted its documented default credentials. From that console they ran their own code on the identity servers and changed the email address and password on a test customer account. The researchers reported the flaw to the two automakers and referenced ForgeRock’s hardening guidance advising removal or extra protection of the console before deployment.
Unlocking and starting a car through a hijacked account
After taking control of the test account, the researchers logged in through the normal consumer app and remotely unlocked and started the test vehicle while the vehicle’s owner was present. The active session exposed the vehicle’s location and telemetry. Shah and Curry wrote that they could have created a session for any customer account on the affected deployments. They also observed that changing an account’s login details left the owner's existing app session active, and that they could divert the app’s notifications away from the owner’s phone.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleA separate chain against an Australian system, researched in July 2026
In a companion post, Shah described a different chain of problems against one automaker’s Australian systems, researched in July 2026. That chain, the write-up says, could begin from a car’s number plate and proceeded through hardcoded administrator credentials, a WAF bypass and a misconfigured multi-factor authentication step to allow account takeover and remote unlocking. The exposed data included customers’ names, phone numbers and password hashes. Together, the write-ups covered vehicles in Australia, the United States and Canada. The researchers noted they tested only on cars they owned or had permission to use.
Fixes, disclosure, and vendor outreach
According to the researchers’ write-up, both automakers fixed the issue about two hours after it was reported and rotated affected credentials. The researchers said they pointed the companies to ForgeRock’s hardening guidance to remove or protect administrative consoles. The reporting noted that Ping Identity, which now includes ForgeRock, was contacted for comment but did not respond by the time of publication. Shah’s companion post does not say when the Australian findings were reported to the automaker or whether those findings have been fixed.
What this means for technologists, automakers, and vehicle owners
- Technologists and security teams: Administrative consoles and default credentials remain high-value targets; the researchers explicitly pointed to vendor hardening guidance and demonstrated how remote code execution on identity servers can lead to account takeover and live vehicle control.
- Automakers and procurement leaders: Deployments that expose identity-management consoles to the public internet or rely on documented default credentials risk rapid compromise; in this case both affected automakers rotated credentials within hours after notification.
- Vehicle owners and customers: A hijacked account can expose vehicle location and telemetry, allow remote unlocking and starting, and divert app notifications, all while leaving an owner’s existing app session active.
The episode is a compact illustration of how layered failures — default or hardcoded admin credentials, WAF bypasses and misconfigured MFA — can be chained to reach physical systems from a software fault. The researchers’ public write-ups document fixes enacted within hours in the reported cases, but Shah’s companion post leaves open whether the Australian chain was reported or remediated. Ping Identity was contacted for comment and had not replied by the time of publication.
Source: https://www.infosecurity-magazine.com/news/forgerock-openidm-default-password/
