Researchers Exploit ForgeRock Default Credentials to Remotely Unlock Cars
Original title: Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars
Researchers remotely accessed vehicle data and controls after RCE on production ForgeRock servers; automakers fixed the flaws in hours.
Researchers discovered a vulnerability chain in ForgeRock Access Management used by two automakers. Default admin:admin credentials on an exposed Apache Felix console allowed remote code execution on production servers. This enabled token generation for vehicle APIs, granting access to locations, status, and remote engine commands. Automakers confirmed the issue and rotated credentials after the disclosure.
Unconfirmed: Researchers claim controlled research; no criminal campaign reported
- Flaws found in early 2026
- Disclosed November 7
- Fixed within two hours of report
- Tested only with US accounts and vehicles
- Exposed full vehicle control chain
- Vendors
- ForgeRock
- Products
- ForgeRock Access Management
- Countries
- United States
From the original article
2 min read at cybersecuritynews.com
Researchers used default admin:admin credentials as part of a vulnerability chain that let them run code on two automakers’ production ForgeRock servers and remotely unlock connected cars. Found in early 2026 and disclosed on November 7, the flaws also exposed vehicle locations and supported remote engine commands. The findings came from controlled security research, not […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.