Default ForgeRock Password Exposed Two Automakers’ Connected-Car Accounts

Security researchers found that a default administrator password on identity servers used by two automakers could expose customer accounts and connected-vehicle controls. The weakness let them take over accounts through the companies’ mobile apps and, in tests on authorized vehicles, unlock doors and start an engine.

The affected systems used ForgeRock, an identity platform now part of Ping Identity. The automakers are not named in the available account of the research. Shubham Shah and Sam Curry said they tested the complete U.S. attack chain in February 2026, using their own accounts and vehicles or those of consenting owners. They reported the issue, and both U.S. systems were fixed about two hours later.

Exposed administration console

The researchers traced the apps’ sign-in process to ForgeRock’s identity services. One component handled authentication, while OpenIDM stored customer records. OpenIDM included an administrator console powered by Apache Felix. ForgeRock’s hardening guidance advises operators to remove the console or secure it before putting a system into production, since it has a separate password.

On the affected U.S. servers, the console remained available behind a network restriction and retained its documented default credentials: “admin” as both username and password. The console was not directly open to the public internet, but the researchers found that a discrepancy in how an edge control and the Java server interpreted a web path allowed them to reach it. The source describes the technique but does not provide a reason to treat it as a newly discovered product vulnerability.

After logging in, the researchers used the console’s built-in scheduler to run scripts on the identity server. That access gave them a command prompt on a system holding records for both brands’ customer logins. They then changed a targeted account’s email address and password, signed in through the normal mobile app and obtained the access tokens the app uses.

From account access to vehicle commands

With the account’s legitimate vehicle controls, the researchers sent commands to unlock and start a test car while its owner stood nearby. They then stopped the engine and locked the vehicle. The researchers said they could open a session for any customer account on the affected servers, but limited vehicle testing to cars they owned or had permission to use.

The account changes could also be difficult for an owner to spot. The researchers reported that changing an email address and password did not sign the owner out of the app. They could redirect account alerts to their own phone, preventing those notifications from reaching the owner during the test. They restored the account’s original email address afterward.

Shah also described a separate attack against the same brands’ Australian systems. In that case, administrator credentials for the identity server had been left in the app’s code for a test setup. The Australian route differed from the U.S. console exposure. Together, the researchers said, the two attack paths could enable commands to cars in Australia, the United States and Canada. The Australian account did not state when those systems were fixed.

Checks for identity teams

The findings point to deployment and configuration failures, not a newly identified flaw in ForgeRock itself. The report describes no CVE, and the product’s production guidance already calls for removing the Apache Felix console or changing its default password. There is also no information in the account establishing whether anyone else accessed the systems before remediation.

Organizations operating ForgeRock or PingIDM should inventory identity servers and check whether the Apache Felix console is present at /system/console. If it is needed, administrators should replace default credentials and restrict access appropriately; otherwise, they should remove it in line with vendor hardening guidance. Teams should also review application code and deployment artifacts for credentials intended only for testing.

The incident is a reminder that identity infrastructure can become a direct control point for connected services. A web application may use valid tokens and normal account functions even after an attacker has gained access through a misconfigured identity server. Network filtering alone should not be treated as a substitute for securing administrative interfaces, especially where intermediaries and application servers may parse requests differently.