VULNpocalypse
HighVulnerabilityPatch available

ForgeRock default admin password exposed two automakers’ apps

Researchers used a default ForgeRock console password to take over two automakers’ login servers; check for the Felix console and remove it.

Published
Fixed in
Both automakers fixed their servers about two hours after the report; the Australian fix date is not confirmed
Exploitation
No, the work was controlled research on consenting owners’ cars; whether anyone else used the path is not confirmed

What happened

Security researchers Shubham Shah and Sam Curry found that the login systems behind two car brands’ mobile apps could be taken over completely, according to The Hacker News. Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity. The platform runs in two parts: one for login and one, OpenIDM, that holds customer records.

OpenIDM ships with a built-in administrator console powered by Apache Felix. On these servers the console was still there and still used the documented default: “admin” as both username and password (The Hacker News).

A web application firewall blocked direct access to the console. Cyber Security News reports that specially encoded paths made requests look like static file requests to the firewall, while Jetty, the backend web server, read them as console requests. The Hacker News describes the same mismatch between the edge and the Java server behind it.

From the console, the researchers created a scheduled task that ran their own code on the identity server. Cyber Security News says the task ran Groovy code and was used to install a small Java component, which confirmed code execution inside the production identity process, not inside the cars.

From there they changed a test account’s email and password, signed in through the normal app, and received the same access tokens the app uses. Those tokens exposed the account’s vehicles and remote controls. With the owner beside the test car, the researchers unlocked the doors, started and stopped the engine, and locked it again (The Hacker News, Cyber Security News). Cyber Security News adds that the tokens also exposed vehicle location and status.

Scope and timing, as reported:

  • Testing: The Hacker News says the full attack was tested only on the researchers’ own and consenting owners’ cars in the United States, in February 2026. Cyber Security News says the work was found in early 2026 and disclosed on November 7, and that it was controlled research, not a reported criminal campaign.
  • Fix: both outlets say the automakers fixed the problem about two hours after the report. Cyber Security News adds that affected credentials were rotated.
  • Australia: The Hacker News says Shah published a second attack on the Australian systems behind the same brands, where admin credentials for the identity server had been left in the app’s code, intended for a test setup. The researchers said the two attacks together could send unlock and engine-start commands to the brands’ cars in Australia, the United States and Canada. The Australian post gives no fix date, so that date is not confirmed.
  • Stealth: The Hacker News says changing the email and password did not log the owner out, and the researchers could redirect the account’s alerts to their own phone. The researchers restored the real email after the test. Cyber Security News notes that restoring the original email did not cancel the new tokens.

The Hacker News states there is no CVE and no vendor advisory, because the problem was how the brands ran ForgeRock, not a new product bug. Cyber Security News’s headline calls it a “ForgeRock RCE” and refers to “flaws”, but its body describes the same configuration and URL-handling chain, and it cites no CVE. The two automakers are not named in either article (not confirmed). Neither write-up says whether anyone else found or used the path before it was closed (The Hacker News).

Am I affected?

You are potentially affected if you operate ForgeRock OpenIDM, now sold as PingIDM, and its Apache Felix web console is still present with the default credentials. Ping Identity’s production hardening guide already tells operators to remove or protect that console and change its default credentials. It also warns that console authentication is separate from IDM authentication (Cyber Security News).

If you only own a car from an affected brand, the sources do not name the brands and give no owner action. Both automakers’ systems were reported fixed. Whether other parties accessed the path is not confirmed.

What to do now

  1. Look for the Apache Felix console at /system/console on your OpenIDM or PingIDM servers (The Hacker News).
  2. Remove the console, or change its default password, as the production hardening guide advises (Cyber Security News).
  3. Do not rely on edge or WAF path rules to hide an admin page. A path that the edge and the server read differently can slip past the rules, as it did here (The Hacker News).
  4. Check that no admin credentials for identity servers are left in app code, including code meant for test setups. This was the entry point in the Australian attack (The Hacker News).

Sources