ForgeRock Misconfigurations at Two Automakers Enabled Account Takeover and Remote Car Control

Researchers Shubham Shah and Sam Curry disclosed security failures in two unnamed automakers’ identity systems that enabled customer account takeover and remote connected-vehicle commands. In the U.S. attack chain, inconsistent URL parsing between edge filtering and backend services exposed a ForgeRock OpenIDM deployment’s Apache Felix console, where default administrator credentials remained active. The researchers used OpenIDM scheduling functionality to execute code, recovered administrative credentials, and modified customer records to obtain legitimate mobile-app access tokens. Authorized testing with U.S. accounts and vehicles in February 2026 demonstrated access to vehicle information and door-locking, unlocking, engine-start, and engine-stop functions.

A separate Australian attack relied on administrator credentials embedded in application code. The researchers reported that the combined attacks enabled vehicle commands in Australia, the United States, and Canada, although the full U.S. attack chain was demonstrated only on vehicles they owned or whose owners consented. Both automakers reportedly remediated the issues approximately two hours after disclosure, removed the researchers’ proof bundle, and rotated affected credentials. The findings concern deployment and configuration failures rather than a newly discovered ForgeRock product vulnerability; the available reporting provides no evidence that other parties exploited the weaknesses.