Researchers remotely commanded cars through two automakers’ Android apps
Original title: Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns
Chains used ForgeRock defaults and WAF path-traversal bypasses; both unnamed automakers patched within two hours of disclosure.
Shubham Shah of Assetnote and Sam Curry showed they could start engines, unlock doors, flash headlights, and honk horns on connected cars in Australia and the United States. Both chains abused ForgeRock identity systems used by two unnamed automakers, combining public VIN lookups, hardcoded or factory-default admin logins, and path-traversal WAF bypasses to take over owner accounts. The US path also reached Apache Felix and ran an inline Groovy script for shell access. The researchers reported the issues in early 2026, and the automakers patched them within two hours.
Unconfirmed: Onlookers speculated the automakers were Toyota and Lexus; Toyota neither confirmed nor denied it.
- Australian app queries returned owner personal information and email addresses from a VIN.
- Staging ForgeRock OpenIDM admin credentials also worked in production, the researchers said.
- US access used factory-default credentials on Felix’s OSGi Web Console.
- Curry said they kept the manufacturers anonymous because of security teams’ workloads.
Impact: Remote engine start, unlock, lights, and horn commands
| Product | Affected |
|---|---|
| ForgeRock OpenIDM | — |
| Apache Felix OSGi Web Console | — |
- Products
- OpenIDMApache Felix
- Organizations
- Assetnote
- Countries
- AustraliaUnited States
From the original article
2 min read at theregister.comPair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.