A series of basic backend vulnerabilities in the connected-vehicle platforms of two major automakers allowed security researchers to remotely unlock doors, start engines, and access customer accounts across multiple countries. The vulnerabilities, discovered in early 2026, have since been resolved by the affected companies.

Extensive Telematics and Personal Data Exposed

The findings were published by cybersecurity researchers Shubham Shah and Sam Curry. While conducting security assessments of the automakers’ server application programming interfaces (APIs), the researchers uncovered weaknesses that granted them unauthorized access to vehicles and extensive backend telemetry.

Beyond remotely sending physical commands to disengage door locks and turn on vehicle engines, the flawed endpoints exposed an array of vehicle information. This telemetry included real-time vehicle location, mileage, fuel levels, remaining driving range, and door open or closed states. In addition to vehicular metrics, the exposed endpoints exposed sensitive personal information belonging to vehicle owners.

The researchers have not publicly disclosed the corporate identities of the two car companies. However, their findings showed that Automaker #1 was vulnerable across its United States vehicle fleet. Automaker #2 was susceptible across Australia, the United States, and Canada. Visual observations of the researchers’ demonstration material, which featured a RAV4 sport utility vehicle, suggest that Automaker #2 may be Toyota, though this identification remains unconfirmed by the researchers.

Unprotected Portals and Hard-Coded Secrets

Both vehicle manufacturers relied on ForgeRock authentication and authorization platforms for their identity management systems. With one small exception noted by the researchers, the vulnerabilities stemmed from flawed developer implementations and deficient operational security practices rather than flaws within ForgeRock’s core platform.

The initial entry point into Automaker #2’s infrastructure began with the decompilation of the company’s Android mobile application. By auditing network requests within the code, Shah identified network calls routed to a dedicated telematics subdomain. This discovery revealed an accessible web location labeled “admintool,” which hosted a “TEST HARNESS” login portal directly exposed to the public internet.

An inspection of the assets served by that portal highlighted further lapses. A JavaScript bundle deployed to the site had not been stripped or minified before release, leaving behind code that outlined the entire functionality of the telematics backend. Within this bundle, the researchers discovered embedded API keys that directly allowed the extraction of customer information.

By correlating publicly available vehicle registration data, the researchers matched a vehicle license plate to its corresponding Vehicle Identification Number (VIN), successfully linking that vehicle to an owner profile and retrieving the customer’s email address.

Circumventing Defenses and Exploiting Multi-Factor Flaws

The researchers spent several weeks analyzing how ForgeRock’s mechanisms had been deployed across the automakers’ environments. The primary objective became minting an unauthorized access token for arbitrary accounts. This process was accelerated after uncovering another publicly accessible endpoint containing a JavaScript bundle with hard-coded administrator credentials, likely left over from a staging environment.

Although a Web Application Firewall (WAF) guarded the service endpoints, gaps remained accessible. Reverse-engineering of the mobile application code pointed the researchers toward a service designated as “pinService,” which bypassed the firewall’s access restrictions. From that access point, the team reached an endpoint named “getUser.”

Using the previously harvested admin credentials alongside target identifiers such as email addresses, phone numbers, or user IDs, the researchers retrieved user details, including stored password hashes. Because the hashes were encrypted using the SHA-512 algorithm, directly cracking them proved computationally unfeasible.

To bypass the hash barrier, the researchers deployed GPT-5.6 Sol Ultra to systematically brute-force potential API path names. The model located an unprotected route that allowed the direct overwriting of existing customer passwords, enabling the researchers to execute partial account takeovers.

The final obstacle to complete account impersonation was multi-factor authentication (MFA). However, the implementation within Automaker #2’s Australian infrastructure contained a configuration oversight that permitted users to bypass MFA requirements entirely. By manipulating authentication tokens across specific endpoints and the mobile application interface, the researchers minted valid access tokens to impersonate target user accounts.

Once authenticated as legitimate vehicle owners, the researchers transmitted an authorized API command instructing the test vehicle to disengage its locks. The target vehicle responded immediately by unlocking its doors, confirming end-to-end exploitability before the vulnerabilities were reported and subsequently patched.