Default ForgeRock Password Let Researchers Unlock and Start Cars

Two automotive mobile apps run authentication through ForgeRock, now part of Ping Identity, and researchers Shubham Shah and Sam Curry found an administrator console on thoseForgeRock servers that still used a default password: admin for both the username and the password. The flaw allowed them to reach the built‑in OpenIDM admin console via a tricky edge‑case path permutation, while the console itself remained inaccessible from the public internet.

Using the console’s scheduler, they executed code on the identity server to gain a command prompt and access customer data held in the same server that powers the brands’ login systems. From there they could alter a target account’s email and password, sign in as that customer through the normal app, and obtain the same access tokens the real app uses.

With those tokens, the researchers were able to unlock and start test vehicles, though they state they only performed vehicle commands on cars they owned or were authorised to use. The full demonstrations were conducted in the United States in February 2026, and both brands fixed the issue about two hours after disclosure.

A second attack on Australian systems tied to the same brands used a different entry: admin credentials for the identity server had been left in the app’s code for a test setup. Combining both investigations, the researchers asserted they could send unlock and engine‑start commands to vehicles in Australia, the United States and Canada, though the Australian fix date was not disclosed.

The researchers emphasised that the vulnerability was a misconfiguration in how ForgeRock was operated, not a new product flaw, and they noted no CVE or vendor advisory exists for this issue. Identity teams should check for the Apache Felix console at /system/console and remove or change its password, and not rely on edge rules to conceal an admin path, as the edge/ server path handling enabled the exploit in this case.