Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

Researchers Use Default ForgeRock Credentials to Unlock Cars

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Default admin:admin on ForgeRock Apache Felix console used to remotely unlock and start test cars in two automakers' systems in US and Australia.

Researchers accessed two automakers' ForgeRock-based apps using exposed Apache Felix admin console with default admin:admin credentials. They bypassed edge protections via encoded slashes, modified customer accounts, and generated tokens for vehicle control. A similar chain enabled RCE on production servers. Automakers confirmed the issues and rotated credentials within hours of disclosure, with tests limited to consenting owners' vehicles.

Key facts
  • Default admin:admin on Apache Felix console at /system/console
  • Bypassed edge rules with encoded slashes
  • Modified accounts and obtained access tokens for car control
  • ForgeRock Access Management flaws in two automakers' systems
  • Fixed within hours of November 7 disclosure
  • Tested only on US and Australian test cars
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 7, 2026ForgeRock flaws discovered and disclosed · Cyber Security News
  2. Nov 9, 2026Researchers demonstrated car control and automakers confirmed fixes · The Hacker News

What each outlet adds

beyond the shared facts
  • The Hacker NewsBypassed edge rules with encoded slashes, modified accounts for test cars in US and Australia
  • Cyber Security NewsRCE on production servers, flaws in early 2026, fixed within two hours
Vendors
ForgeRockping identity
Products
ForgeRock Access Managementforge rock openidm
Victims
two automakers
Countries
United Statesunited statesaustraliacanada

Coverage

oldest first · one row per article · UTC
  1. · 5h ago The Hacker NewsFirst report

    Default admin:admin password helps researchers hack two car apps

    Researchers used default ForgeRock admin credentials to access customer accounts and control test cars in the US and Australia.

  2. · 3h ago Cyber Security News

    Researchers Exploit ForgeRock Default Credentials to Remotely Unlock Cars

    Researchers remotely accessed vehicle data and controls after RCE on production ForgeRock servers; automakers fixed the flaws in hours.