Default 'admin:admin' Password in ForgeRock Servers Allowed Car App Hacks

Vulnerability Discovery

Security researchers Shubham Shah and Sam Curry discovered a critical vulnerability in the login systems of two car brands' mobile applications. The flaw allowed them to completely take over customer accounts, which could then be used to unlock and start connected vehicles.

Exploiting Default Credentials

Both affected car apps utilized ForgeRock, an identity platform, for customer sign-ins. The researchers found that the OpenIDM component of ForgeRock, which stores customer records, had an administrator console accessible via its default 'admin:admin' username and password. This console, powered by Apache Felix, was not properly secured despite ForgeRock's hardening guidelines recommending its removal or protection before deployment.

Bypassing Network Protections

Although the console was blocked from direct internet access, the researchers bypassed this protection. They manipulated web requests by adding encoded slashes and extra characters, causing the network edge to treat the request as a harmless static file while the backend server interpreted it as a path to the console. Once inside, the default credentials granted full access.

Account Takeover and Vehicle Control

Within the administrator console, the researchers executed scripts to gain a command prompt on the identity server holding customer records. They then modified a target account's email and password, logged in as that customer through the legitimate app, and obtained valid access tokens. These tokens enabled them to send commands to a test vehicle, successfully unlocking its doors and starting its engine.

Resolution and Impact

The researchers conducted their tests in February 2026 on their own and consenting owners' vehicles in the United States. The vulnerability was reported to the affected parties and was patched approximately two hours after disclosure. This incident highlights the critical importance of adhering to security best practices, such as changing default passwords and properly configuring administrative interfaces, especially in systems handling sensitive user data and vehicle controls.