Security Researchers Expose Critical Vulnerabilities in Global Connected Car Platforms
Researchers discovered flaws allowing remote vehicle access through exposed identity management systems and admin tools.
1Research Scope and Methodology
Security researchers Shubham Shah and Sam Curry investigated the digital infrastructure of major automakers. By decompiling mobile applications and analyzing internet-facing web services, they identified significant security gaps. Their work focused on the backend systems that manage connected vehicle features, rather than traditional hardware-based automotive hacking methods or physical vehicle components.
2Identity Platform Vulnerabilities
The researchers discovered that two major car brands utilized the ForgeRock identity platform, now part of Ping Identity. Crucially, the administrative console for the OpenIDM component remained active with default 'admin' credentials. Despite hardening guides advising removal, these consoles were left accessible, providing a direct entry point into customer account databases.
3Bypassing Edge Security Controls
Although the administrative consoles were ostensibly blocked from the public internet, researchers bypassed these protections. By utilizing encoded slashes and specific character manipulation, they tricked the edge security layer into treating requests as static files. This allowed the backend server to process the path to the console, enabling unauthorized administrative access.
4Remote Code Execution Risks
Once inside the administrative console, the researchers leveraged a built-in scheduler to execute custom scripts directly on the identity server. This granted them a command prompt on the machine hosting sensitive customer records. From this position, they could manipulate account data, including changing email addresses and passwords to hijack user sessions.
5Australian Infrastructure Exposure
In a separate analysis of Australian systems, researchers found hardcoded API keys within the mobile application's JavaScript bundle. These keys granted access to an 'admin tool' test harness. This tool allowed employees to interact with production vehicles and customer accounts with minimal authentication, further exposing the automaker's connected car ecosystem to exploitation.
6The Chain of Exploitation
The Australian attack chain demonstrated how easily a vehicle could be compromised. By obtaining a number plate, researchers retrieved the Vehicle Identification Number (VIN) via public registration sites. Using the VIN, they accessed the subscriber GUID and associated account PII, eventually gaining the ability to issue remote commands to the specific vehicle.
7Vehicle Control Capabilities
By hijacking legitimate account tokens, the researchers successfully performed remote actions on test vehicles. They demonstrated the ability to unlock doors and start engines. Because they used the account's own authorized commands, the actions appeared legitimate to the vehicle's system, leaving the actual car owner unaware that their account had been compromised.
8Stealth and Account Hijacking
The attack was designed to remain undetected by vehicle owners. By modifying account details and redirecting alerts to their own devices, the researchers could maintain access without triggering notifications on the owner's phone. They noted that changing credentials did not force an immediate logout from the mobile application, facilitating persistent unauthorized control.
9Response and Remediation
The researchers conducted full-scale tests only on their own or consenting owners' vehicles in the United States during February 2026. Upon reporting the vulnerabilities, the affected systems were patched within approximately two hours. The researchers emphasized that these were configuration errors rather than new software bugs, requiring no specific CVE identification.
10Industry-Wide Security Patterns
This discovery follows a broader trend of web-based vulnerabilities in the automotive sector. Previous research by Shah and Curry has exposed similar flaws in brands like Honda, Kia, and Subaru. A 2023 study covering 16 different brands highlighted that web infrastructure weaknesses remain a persistent and widespread issue across the automotive industry.
11Hardening Identity Infrastructure
For organizations using identity software like PingIDM, the incident underscores the necessity of rigorous hardening. Security teams must ensure that administrative consoles are removed or strictly protected before deployment. Furthermore, developers should avoid hardcoding API keys in client-side code, as these can be easily extracted through basic reconnaissance of application bundles.
12Future Security Implications
As vehicles become increasingly connected, the security of the backend identity platform is as critical as the vehicle's internal network. The ability to bridge the gap between web-facing infrastructure and physical vehicle control represents a significant threat surface. Automakers must prioritize securing these digital gateways to prevent potential large-scale unauthorized vehicle access.