All net-connected vehicles from two major automakers allowed hackers to remotely unlock doors and start the engine

Before proceeding further, we'd like to advise our dear reader to sit down and perhaps grab a helmet, for this post will elicit quite a few face-palms and forehead-slaps. Two security researchers joined forces and, during early 2026, managed to hack the vehicle connectivity backend infrastructure of two automakers, managing to remotely open the doors on any of their net-connected cars and start their engines across multiple world regions.

The vulnerabilities were quickly fixed, and they pertained to a handful of belief-begging security issues with multiple server APIs that their respective mobile applications use. Furthermore, although remotely opening the cars and starting them were the most concerning bits, the vulnerabilities also exposed the vehicles' location, mileage, fuel, range, door states, and the customers' personal information.

The white-hat hacking duo isn't disclosing the name of the impacted automakers, but they managed to get access to Automaker #1's U.S. vehicles, while vehicles from Automaker #2 were susceptible to unplanned lock disengagement in Australia, the U.S., and Canada. As far as we can tell by visual inspection alone, the second firm may be Toyota, as the hack demonstration video appears to depict a RAV4 SUV.

Both affected automakers use ForgeRock's authentication and authorization services, though with the one small exception, the vulnerabilities found by Shubham Shah and Sam Curry pertained to poor implementations and security practices. One of their writeups goes over the ForgeRock-related affairs in detail for both companies, while Shah's article discusses the specifics on automaker #2 and their Australian connected-car infrastructure.

Shah first decompiled the company's Android application and found network calls to a telematics subdomain, quickly finding an "admintool" location containing a "TEST HARNESS" page with a login prompt. If you haven't been keeping track by now, the first problem is that this endpoint is reachable from the internet at large. But what really piqued Shah's interest was problem #2: a bundle of JavaScript code that should have been stripped of any unnecessary cruft actually contained the code for the backend's entire functionality, providing a map for further shenanigans.

This alone was enough to grant Shah the ability to pull up customer information with API keys that were hard-coded into said JavaScript. After some careful chaining of requests and connecting a license plate to a VIN with publicly available info, he connected that to a customer and found their email. At this point, the team noticed that the automaker was using ForgeRock's authentication mechanisms, and spent "a couple weeks" finding how they were used.

And this is also where they assess that the easiest path to victory is managing to mint an access token for any user, a task made way easier by the "cursed" JavaScript bundle they found at an endpoint containing hard-coded administrator credentials. These were likely meant for the staging environment, but the duo estimated, correctly, that they could be leveraged nevertheless.

At this point, they ran into the WAF in front of the service. A Web Application Firewall is similar to a network firewall, but instead of working with IPs and ports, it considers endpoints (URLs) and the requirements to access them. The researchers hypothesize that although it's a good and standard practice, the WAF was put in place because of how bad things were underneath.

And they were right. The app decompilation had revealed a "pinService", and Shah found that it was accessible through the WAF. From thereon, they found "getUser", and correctly guessed that they could retrieve users' information with their email, phone, and ID. Remember those admin credentials? They came in handy, revealing the users' password hashes, but as these were SHA-512, cracking them was unfeasible.

At this point, they let GPT-5.6 Sol Ultra loose to brute-force path names, and found an unprotected one that ultimately let them overwrite any user's password, partially enabling taking over their accounts. However, there was still MFA to contend with.

As it turns out, even that too was misconfigured, as the Australian environment would let users skip MFA entirely. With some judicious token shuffling across endpoints and the mobile app, they eventually could mint access tokens, letting them fully impersonate any user account... and unlock their cars. Then, it was as simple as sending out an API request for the "door-unlock" command, and sure enough, the test car promptly opened.