Security Breach Exposes Risks in Automotive Customer Accounts
Recent findings from cybersecurity researchers have highlighted a significant vulnerability in the customer account systems of two major car brands, casting a spotlight on issues related to digital security in the automotive industry. Researchers Shubham Shah and Sam Curry detailed their discovery in a comprehensive write-up published on November 7, outlining how they demonstrated their ability to remotely unlock and start a vehicle after accessing an administration console on the brands’ login servers, which still operated under its default password.
The identity management software utilized by these brands, OpenIDM—a system developed by ForgeRock, now part of Ping Identity—serves as the foundation for customer logins. In an interesting twist, the specific brands involved have chosen to remain unnamed, fitting their request for anonymity in this disclosure.
Upon uncovering the vulnerability, Shah and Curry took immediate steps to inform the two automotive manufacturers, emphasizing the importance of adhering to ForgeRock’s established guidelines for securing the console before deployment. The seriousness of such vulnerabilities cannot be understated, especially as connected vehicles become increasingly common and reliant on digital infrastructures.
Unlocking a Test Vehicle: A Startling Demonstration
In early 2026, the researchers exploited an opportunity by circumventing the web application firewall (WAF) that stood between them and the login servers. They successfully discovered that the administration console could still be accessed using its default credentials, presenting a critical hole in security protocols. This oversight enabled them to run custom code on the identity servers and manipulate a test account, leading to the alarming step of altering the account’s email address and password.
After compromising the account, they were able to log in through the standard application, consequently unlocking and starting the test car with the vehicle’s actual owner present. This bold demonstration not only compromised the vehicle’s security but also provided the researchers with sensitive information, such as the vehicle’s location and telemetry data. The researchers indicated that the ease with which they could gain access to any account on the affected systems highlighted a significant risk; changing the login information left the legitimate owner’s session active, allowing the researchers to redirect app notifications away from the rightful account holder.
Responding promptly to the security breach, both automotive companies rectified the issue merely two hours after it was reported. They initiated a rotation of affected credentials to mitigate any potential risks further.
Additional Vulnerabilities Discovered in Australian Systems
In a related post, researcher Shubham Shah expanded on separate findings regarding one of the manufacturers’ Australian systems. This investigation, conducted in July 2026, unveiled a distinct chain of vulnerabilities that originated from a vehicle’s number plate. The researchers detailed a troubling sequence involving hardcoded administrator credentials, another bypass of a web application firewall, and misconfigured multi-factor authentication (MFA) measures, all of which facilitated account takeovers and the remote unlocking of vehicles.
The implications of such security failures are extensive, as exposed data included sensitive customer information like names, phone numbers, and encrypted password hashes. Shah’s findings indicated that the vulnerabilities spanned vehicles across Australia, the U.S., and Canada, although the researchers confirmed that they limited their tests to vehicles they owned or had explicit permission to investigate.
It is noteworthy that Shah’s separate post does not clarify whether these Australian vulnerabilities have been reported to the manufacturers or if any remediation has been initiated. Furthermore, neither of the researchers’ reports indicated any malicious exploitation of these vulnerabilities nor confirmed whether they performed comprehensive checks for potential abuses.
As concerns surrounding digital security in the automotive sector continue to mount, calls for stringent protective measures are growing louder. The implications for consumer trust and safety are immense, urging car manufacturers to adopt a proactive stance in the face of technological advancements that, while beneficial, inevitably introduce new risks.
The investigative duo made attempts to reach out to Ping Identity for a comment on these findings, but as of the article’s publication, there had been no response. The ongoing dialogue surrounding cybersecurity in the automotive realm remains crucial as manufacturers work to build more secure frameworks to protect their customers.
In an era where connected vehicles are increasingly becoming part of everyday life, ensuring robust digital security measures should be at the forefront of automotive innovation, safeguarding against potential exploitation and fostering trust among consumers.