"The US attack required a lot more work," Shubham Shah said, "because the automaker spent much more time securing the US, Canadian, and European OpenIDM environments." That assessment, from one of two security researchers who reverse-engineered automakers' Android apps, frames a finding with immediate operational implications: weaknesses in the identity stack allowed remote control commands — unlocks, horn blasts, headlight flashes and engine starts — to be issued to cars in multiple countries.
Central failure: ForgeRock identity platform weaknesses
Shubham Shah (co‑founder at Assetnote) and researcher Sam Curry both traced their exploit chains to weaknesses in the ForgeRock identity platform used by two unnamed automakers. The pair published separate blogs describing different aspects of the research and said both attack paths centered on ForgeRock OpenIDM environments. The researchers previously have highlighted flaws affecting other manufacturers, and they treated the automakers' identities as confidential at the companies' request.
Australian app chain: VIN harvesting, staging credentials and path traversal
In the Australian version of the mobile app the researchers began by finding vehicle identification numbers (VINs) using public licence plate checkers. They used those VINs in queries to internal APIs that returned personal information and owners' email addresses. The researchers also discovered hardcoded admin credentials for the ForgeRock OpenIDM that were intended for the staging environment but also worked in production.
After bypassing "heavy WAF filtering" by exploiting path traversal flaws, they said they were able to invoke internal admin APIs and take over target accounts using only the owners' email addresses. That access allowed them to mint authentication tokens and issue arbitrary commands to affected vehicles through the mobile app.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadUS app chain: path confusion, Apache Felix and remote shell access
The US exploit required a more involved sequence, Shah said. It also began with a WAF bypass through path traversal, but the researchers used "path confusion" to reach the Apache Felix admin console. There they used factory default credentials in Felix’s OSGi Web Console to obtain admin privileges.
From Felix they used the configuration manager to schedule a task that executed an inline Groovy script, which in turn gave them shell access to the identity servers. With that shell they queried local admin API endpoints to view and modify user account data, logged into car owners' accounts, and then issued the same remote vehicle commands demonstrated in the Australian tests.
Disclosure timeline, mitigation and vendor anonymity
According to Curry’s disclosure timeline, he and Shah approached the affected automakers in "early 2026." The researchers report the exploits were patched within two hours of the vendors receiving the report. Both researchers said they honored the automakers' requests to remain anonymous; Curry explained their decision: "Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure."
Despite the anonymity, some observers speculated that the partially blurred car in Shah's demo video resembled a Toyota and that the two affected brands might be Toyota and its luxury brand Lexus. A spokesperson for Toyota Motor Corporation "neither confirmed nor denied" those claims, according to the reporting.
What this means for technologists, automakers, and vehicle owners
- Technologists and security teams: Pay close attention to identity-platform configuration, the presence of hardcoded or staging credentials in production, and the risk of WAF bypass via path traversal or path‑confusion techniques — all of which appear in these exploit chains.
- Affected automakers and procurement leaders: The researchers' rapid remediation — patches deployed within two hours of disclosure — underscores the value of coordinated vulnerability handling and of removing default or factory credentials in components such as Apache Felix and OSGi consoles.
- End users and vehicle owners: Publicly accessible registries and licence‑plate lookups can expose VINs that, when combined with misconfigured identity APIs, enabled account takeover using only an email address in these tests.
The researchers' dual disclosures lay bare a repeated theme: identity and admin interfaces, when left reachable or using default/staging credentials, create high-leverage access paths. Shah and Curry reported their findings, the vendors patched within hours, and the manufacturers asked to stay unnamed — leaving a clear, operational lesson for teams that build connected‑vehicle services: harden identity endpoints, remove test credentials from production, and treat console defaults as active attack surfaces.
