admin:admin on a Login Server Let Researchers Start Strangers’ Cars
Sam Curry and Shubham Shah found a ForgeRock admin console still on its default password behind two car brands' apps, letting them take over any account and unlock and start cars. Both were fixed within hours.
Two security researchers say a default password on the login servers behind two car brands’ apps was enough to take over any customer account and, with it, unlock and start the car. The Hacker News reports that Sam Curry and Shubham Shah found an administrator console on the brands’ ForgeRock identity servers still set to admin/admin. They tested the full chain in February 2026 on their own and consenting owners’ US vehicles, and both systems were fixed about two hours after the report. Neither write-up names the brands.
For defenders
What was wrong: both brands signed app users in through ForgeRock (now Ping Identity’s PingIDM). Its OpenIDM component ships an Apache Felix web console at /system/console with its own separate credentials, and ForgeRock’s production hardening guide says to remove it or change the password before going live. Here it was left on the documented default (T1078.001 (Valid Accounts: Default Accounts)). This is a configuration mistake, not a product bug, so there’s no CVE and no vendor advisory.
How they got in: the console was blocked at the edge, but the edge and the Java server behind it parsed the URL differently. Encoded slashes and padding made the edge see a harmless static file while the server routed to the console (T1190 (Exploit Public-Facing Application)). From there, the console’s built-in scheduler ran their scripts on the identity server (T1053 (Scheduled Task/Job)), giving a shell on the box holding customer records. They changed a test account’s email and password, logged in through the normal app, and used the resulting tokens to send unlock and engine-start commands (T1098 (Account Manipulation)).
A second route: Shah separately found admin credentials for the identity server left in the app’s code for the brands’ Australian systems (T1552.001 (Unsecured Credentials: Credentials In Files)). Together, the researchers say, the two paths reached cars in the US, Canada and Australia. No fix date is given for Australia.
Exploited? No report of anyone else using it. Neither write-up says whether others found the path first. The full method is in Curry and Shah’s technical write-up and Shah’s Australia post.
What it means for you
If you drive a connected car, there’s nothing you need to do about this specific flaw: it was fixed in February. The worrying part is how quiet it was. Changing the account’s email and password didn’t log the owner out of their app, and alerts could be redirected to the attacker’s phone. So if your car app ever sends a “your email was changed” notice you didn’t expect, take it seriously.
Do this now
- Car owners: turn on every account-change alert your car’s app offers and check the email and phone listed on the account.
- Identity teams running ForgeRock or PingIDM: check for the Apache Felix console at
/system/console; remove it or change its password. - Don’t rely on WAF or edge path rules to hide admin pages; test them with encoded and padded paths, or take the page off the internet-facing server entirely.
- App developers: search mobile app builds for embedded admin or test credentials before release.