All net-connected vehicles from two major automakers allowed hackers to remotely unlock doors and start the engine
Any net-connected vehicle from two automakers could be remotely opened and started — now-patched failures with API backend security showcase a lack of 101-level best practices
Two security researchers, Shubham Shah and Sam Curry, uncovered exploitable security flaws in the vehicle connectivity systems of two major automakers in early 2026. These vulnerabilities allowed them to remotely unlock doors and start the engines of any net-connected cars operated by the affected automakers across multiple regions.
The researchers found that the issues stemmed from poor implementation and security practices, particularly within ForgeRock's authentication and authorization services utilized by both companies.
Shah decompiled the automaker's Android application, discovering an admin tool that contained a TEST HARNESS page with a login prompt. This endpoint was reachable from the internet, but a more concerning issue was a bundle of JavaScript code within the application that exposed the backend's entire functionality. This discovery allowed Shah to pull up customer information using hard-coded API keys and map a vehicle's license plate to its Vehicle Identification Number (VIN) using publicly available data, linking it to the customer's email.
The duo spent several weeks analyzing how ForgeRock's authentication mechanisms were used, ultimately finding a way to generate access tokens for any user. The researchers exploited a hard-coded administrator credential in a JavaScript bundle, which they used to access user data such as emails, phone numbers, and IDs. They then used these credentials to obtain password hashes, which were too complex to crack.
However, Shah managed to bypass multi-factor authentication (MFA) in the Australian environment, enabling them to mint access tokens and fully impersonate any user account. This led to the ability to unlock the test car remotely. The researchers concluded that the most effective method to gain control was by leveraging the administrator credentials and token shuffling across endpoints and the mobile app, ultimately allowing them to open the car doors.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
