Subaru STARLINK Admin Portal Flaw Exposed Vehicle Control and Customer Data

Researchers disclosed a critical flaw in Subaru’s STARLINK connected vehicle platform that allowed takeover of an employee-facing admin portal and unrestricted access to customer accounts in the United States, Canada, and Japan. The attack chain reportedly combined an unauthenticated password-reset endpoint, user enumeration, and a client-side-only two-factor authentication barrier that could be bypassed, enabling attackers to look up drivers using identifiers such as name and ZIP code, email address, phone number, VIN, or a VIN derived from a license plate.

With admin access, an attacker could remotely perform actions including locking or unlocking doors, starting or stopping supported vehicles, adding themselves as an authorized user, and tracking a car’s real-time and historical location data for up to a year. The exposed records also included PII, emergency contacts, billing-related details, vehicle PINs, support history, odometer readings, prior ownership, and sales history; researchers demonstrated unlocking a friend’s Subaru without any user notification. Subaru said it patched the issue within 24 hours of disclosure, and the researchers reported no evidence of malicious exploitation.