Researchers used ForgeRock default password to unlock cars

Researchers have demonstrated that two unnamed car brands could be accessed via a default administrator password on OpenIDM, ForgeRock’s identity management software. The findings, published in a write‑up by Shubham Shah and Sam Curry on 7 November, show that the brands’ login servers still exposed the console with its documented default credentials.

After bypassing the web application firewall in front of the login servers, the researchers were able to operate the identity servers, change a customer account’s email address and password, and log in through the normal app to unlock and start a test car while the owner was present. The session also revealed the car’s location and telemetry, and the researchers noted that they could have created a session for any customer account on the affected deployments.

They observed that changing a login detail left the owner’s existing app session active and could divert app notifications away from the owner’s phone. Both automakers addressed the flaw about two hours after it was reported, rotating the affected credentials, according to the write‑up.

The investigation also covers a separate Australian chain against one automaker’s systems, described by Shah in a companion post. That chain purportedly began with a car’s number plate and used hardcoded administrator credentials, a WAF bypass and a misconfigured MFA step to enable account takeover and remote unlocking. Exposed data reportedly included customer names, phone numbers and password hashes.

The posts indicate the researchers tested only on vehicles they owned or had permission to use, and do not state whether any malicious use occurred or whether fixes have been confirmed. Ping Identity was contacted for comment but did not respond by publication.