Researchers Say Default 'admin' Password on Login Servers Let Them Unlock and Start Cars at Two Unnamed Automakers

Two automakers left an administrator console on their customer login servers with the factory-default username and password, both "admin." Researchers Sam Curry and Shubham Shah say that was enough to take over any customer account on those servers and, for owners with connected cars, unlock the doors and start the engine.

The pair published their findings Saturday, Nov. 7. The testing dates to February 2026. The automakers asked not to be named, and the researchers have not identified them.

How the researchers got in

Both brands' Android apps sign customers in through ForgeRock, an identity platform now part of Ping Identity. The system has two parts: one handles login, the other, called OpenIDM, holds customer records.

OpenIDM ships with a built-in administrator console powered by Apache Felix. That console keeps its own password, separate from the rest of the system. On both automakers' servers, the researchers write, the documented default still worked.

The console was not open to the public internet. A web application firewall blocked direct requests and, after repeated attempts, the researchers' IP address.

They got around it with what they call path confusion. The firewall and the Jetty server behind it read the same web address differently. By adding encoded slashes and extra characters, the researchers made a request look like a harmless static file to the firewall while the server treated it as a request for the console.

From there, they used a built-in scheduler to run their own code on the production identity servers. According to the researchers' technical write-up, the server environment also held the OpenIDM administrator's credentials, which let them reach customer records.

From a server to a driveway

The researchers searched customer directories by name, email or phone number. They changed a test account's email address to an inbox they controlled and set a new password. They then signed in through the normal app flow, and the six-digit verification code went to their inbox rather than the owner's.

The login produced the same access tokens the real app uses. Those tokens exposed the account's vehicles, with VINs, models and subscriptions, plus location, telemetry, lock and unlock, and engine start and stop.

With the owner standing beside the car, Shah unlocked the test vehicle and started the engine. He then stopped the engine and locked it again.

The researchers say changing the email and password did not invalidate the owner's existing app session, so the owner would have stayed logged in. They also say restoring the original email did not cancel the tokens they had obtained.

What was and was not tested

The researchers say they could open a session for any customer account on the affected servers, and that the access reached customer directories in several regions. They ran the full chain only on their own or consenting owners' cars in the United States. In their words, they "tested the complete chain only with US accounts and vehicles."

The work was controlled security research. No criminal campaign using the flaw has been reported. Both automakers fixed the problem about two hours after the report and rotated the exposed credentials, according to the researchers.

Shah also published a second attack against Australian systems behind the same brands. There, the entry point was different: admin credentials for the identity server had been left in the app's code, apparently intended for a test environment.

The vendor's own warning

The default password was not a secret. Ping Identity's production hardening guide tells operators to remove the Felix console or protect it before going live, and to change its default credentials. The guide also warns that the console's authentication is separate from OpenIDM's.

That puts the documented responsibility with the operators who deployed the software. The two automakers either skipped that step or did not finish it. The firewall was the only barrier left, and a URL-parsing mismatch got around it.

The firewall was there, and it failed. Blocking an admin URL at the edge is no substitute for locking the service behind it, especially when that service decides who gets to unlock a car.

The researchers drew on earlier work. Curry and Shah previously found similar holes at Subaru, and earlier research examined remote access flaws at Kia.

What remains unanswered

Neither automaker has issued a public statement, and neither has been identified. The researchers say the fix came within about two hours, but no one has said how long the console was exposed with default credentials before February, or whether anyone other than the researchers reached it. Without names, owners cannot find out whether their cars sat on the affected servers.