Hardcoded Admin Credentials Let Hackers Unlock and Start Connected Cars

During early 2026, two security researchers remotely unlocked the doors and started the engine of any net-connected vehicle sold by two major automakers — across multiple world regions — after finding hardcoded administrator credentials, a misconfigured multi-factor authentication flow, and an internet-reachable test page inside the companies' connected-car backends. The vulnerabilities have since been patched, but the writeups read like a checklist of first-day security hygiene failures.

Shubham Shah and Sam Curry, the white-hat duo behind the work, are withholding the automakers' names. They gained access to Automaker #1's U.S. vehicle fleet; cars from Automaker #2 were susceptible to unplanned lock disengagement in Australia, the U.S., and Canada. Tom's Hardware notes that visual inspection of the demonstration video, which appears to show a RAV4 SUV, suggests the second firm may be Toyota — though that remains unconfirmed.

What exactly did the researchers find?

The problems started with a mobile app. Shah decompiled Automaker #2's Android application and spotted network calls to a telematics subdomain. Behind it sat an "admintool" location containing a "TEST HARNESS" page with a login prompt.

The first red flag: that endpoint was reachable from the open internet. The second was worse. A JavaScript bundle that should have been stripped of dead code still contained the backend's entire functionality — effectively a map of every attack surface available.

That bundle carried hardcoded API keys. With them, Shah could pull customer records directly. By chaining requests and matching a license plate to a VIN using publicly available information, he linked a vehicle to a customer and recovered their email address.

How did they take over accounts?

Both automakers use ForgeRock's authentication and authorization services, and the researchers spent "a couple weeks" mapping how the platforms deployed them. The flaws, they stress, were in implementation — not in ForgeRock itself.

The path forward required minting an access token for an arbitrary user. That became dramatically easier thanks to what Shah called a "cursed" JavaScript bundle at another endpoint, which contained hardcoded administrator credentials. The credentials were likely intended for a staging environment. The duo correctly bet they would work in production anyway.

A Web Application Firewall stood in front of the service. The researchers hypothesize it existed precisely because things underneath were bad — and they were right. App decompilation had revealed a "pinService" that remained accessible through the WAF, along with a "getUser" function that returned user information given an email, phone number, or ID.

The admin credentials came in handy again, this time exposing users' password hashes. The hashes were SHA-512, so cracking them was out of the question. Instead, the researchers let GPT-5.6 Sol Ultra brute-force path names and found an unprotected endpoint that allowed them to overwrite any user's password — a partial account takeover.

MFA should have stopped them there. It didn't. The Australian environment let users skip multi-factor authentication entirely. With some judicious token shuffling across endpoints and the mobile app, the pair could mint valid access tokens and fully impersonate any account. A single API request for the "door-unlock" command followed, and the test car promptly opened.

What was exposed beyond the doors?

Remote unlocking and engine starts were the scariest outcomes, but not the only ones. The vulnerabilities also exposed:

• Vehicle location data
• Mileage, fuel level, and driving range
• Door states
• Customers' personal information

The failure pattern is striking in its simplicity. An internet-exposed test harness, credentials baked into shipped JavaScript, an authentication flow that permits skipping MFA, and an unprotected password-reset endpoint — none of these require an advanced nation-state toolkit. They are the kind of findings a competent pre-deployment review should catch, which raises uncomfortable questions about how the affected backends passed any audit at all.

Both automakers fixed the issues quickly once notified, and there is no indication of malicious exploitation before the patch. Curry's writeup covers the ForgeRock-related findings for both companies in detail, while Shah's article digs into Automaker #2's Australian connected-car infrastructure specifically.

The episode lands as automakers pour investment into app-driven vehicle features, remote start among them, making backend authentication the de facto perimeter between a stranger and someone's driveway. Until vendors treat that perimeter with basic discipline — no hardcoded credentials, enforced MFA, stripped production bundles — researchers will keep opening car doors with little more than a decompiler and patience.