Security researchers Shubham Shah and Sam Curry revealed a critical vulnerability in the identity management software OpenIDM from ForgeRock, which is now part of Ping Identity. They discovered that two unnamed car brands were using this software with default administrative credentials, allowing unauthorized access to customer accounts. By exploiting this flaw, the researchers could remotely unlock and start vehicles, demonstrating the potential risks associated with inadequate credential management.
In their detailed report published on November 7, Shah and Curry explained how they bypassed the web application firewall protecting the login servers. They found that the administration console still accepted default credentials, enabling them to execute code on the identity servers. This allowed them to change the email address and password of a test account, log in as a customer, and control a test vehicle's functions. The exposure also included sensitive data such as vehicle location and telemetry.
The researchers informed the affected automakers, who quickly resolved the issue within two hours by securing the console and rotating the compromised credentials. Although the brands were not disclosed, the vulnerabilities were found in vehicle systems in Australia, the US, and Canada. Another investigation conducted in July 2026 involved hardcoded credentials and misconfigured multi-factor authentication on an Australian system from one of the automakers.
While no malicious use of these vulnerabilities was reported, the incident underscores the importance of securing identity management systems and avoiding default passwords. Shah noted that they only tested vehicles they owned or had permission to use. Ping Identity was contacted for their input, but they did not respond before the publication of the report.
