Security researchers exploit default passwords to access connected cars

Security researchers Shubham Shah and Sam Curry discovered a vulnerability that allowed them to take over customer accounts and remotely control connected vehicles. The flaw involved two unidentified automotive brands using the ForgeRock identity platform, which is now part of Ping Identity.

The researchers found that an administrator console for the OpenIDM component of the platform was still using the default credentials, “admin:admin”. By exploiting a discrepancy in how web application firewalls and servers interpreted web addresses, the researchers bypassed security perimeters to access the console.

Once inside, they used a built-in scheduler to execute code on the identity servers, gaining access to customer records. In controlled tests conducted in February 2026, the researchers demonstrated the ability to unlock doors and start engines remotely. The vulnerabilities were patched approximately two hours after being reported to the affected companies.