Default 'admin' Password on Login Server Let Researchers Unlock and Start Cars from Two Automakers

Security researchers Shubham Shah and Sam Curry found that the login systems behind two car brands' mobile apps could be fully taken over. This allowed them to access any customer's account and, for owners with a connected car, unlock the doors and start the engine. Both apps used ForgeRock, an identity platform now part of Ping Identity. On those servers, the researchers reached an administrator console that still used its default password: the word "admin" for both username and password. ForgeRock's own hardening guide tells operators to remove or protect this console before going live.

The console was blocked from the open internet, but the researchers found that the protective edge in front of the site and the software behind it read the same web address differently. That gap let them reach the console, and the default password did the rest. From there they ran their own code on the server that holds customer records, changed a target account's email address and password, and signed in through the normal app. The access tokens they received were the same ones the real app uses, which let them send vehicle commands to a test car, with the owner standing next to it.

The researchers tested the full attack only on their own cars and those of consenting owners in the United States, in February 2026. Both systems were fixed about two hours after the problem was reported. The full technical method is in the researchers' published analysis.