Researchers Remotely Unlocked and Started Cars at Two Unnamed Automakers

Two automakers patched a chain of security flaws roughly two hours after researchers reported it in early 2026, according to a joint write-up published November 7 by security researchers Sam Curry and Shubham Shah. The flaws let the researchers take over customer accounts and send door-unlock and remote-start commands to connected vehicles.

The automakers asked not to be identified, so the write-up refers to them only as Automaker #1 and Automaker #2. Both companies removed the researchers' proof files and rotated the exposed credentials after receiving the report. Shah, co-founder of security firm Assetnote, told iTnews that one carmaker paid no bug bounty and gave no public credit.

What could the researchers actually do?

The researchers say they could "create a valid session for any customer account managed by the affected deployments." Once inside an account, they listed its vehicles and sent unlock and remote-start commands to a car with its owner present. They restored the account afterwards. They tested the complete chain only with US accounts and vehicles, according to the write-up.

Shah says the commands worked across Australia, the United States and Canada, while Europe was better secured. In Australia, the attack started from nothing more than a number plate.

How did the attack chain work?

Both automakers ran their mobile app logins on the same identity platform, ForgeRock. The researchers first got past the web application firewall by exploiting differences in how the firewall, the server and the application parsed the same URL.

That parser confusion exposed an administrative console that accepted default credentials. From there, the researchers ran code on the identity server and changed a customer's email address and password directly in the identity directory.

They then logged in, collected the one-time code sent to the new email address, and swapped the session for mobile app tokens. With those tokens, they reached the account's vehicles and issued the unlock and remote-start commands.

The takeaway: a single weakness in a shared identity platform exposed the entire account, and the vehicle commands followed from there.

What was the simpler Australian route?

Shah's separate post describes a second, simpler attack in Australia. Admin credentials for the ForgeRock OpenIDM platform sat in a vendor JavaScript bundle shipped to app users.

Starting from a number plate, he looked up the VIN on state registration sites and mapped it to a subscriber ID. He then reset the owner's password and skipped multi-factor authentication through an OAuth password grant.

He sent the command and reported the result plainly: "The doors unlocked."

The takeaway: a credential left in publicly shipped JavaScript code collapsed the whole security chain down to a license plate lookup.

Is this part of a pattern?

Curry and Shah have published similar connected-car research before. In January 2025, they disclosed a flaw in Subaru's Starlink service that let them remotely unlock and start cars. Subaru patched that flaw within 24 hours.

The pattern points to a structural issue rather than a one-off mistake. Automakers that share an identity platform inherit the same weak points, and a flaw in the account layer reaches every connected feature tied to it, including the locks and the ignition.

The fast remediation in this case, about two hours, shows vendors can move quickly when pushed. Whether future disclosures receive bug bounties and public credit, as Shah notes this one did not, may shape how willingly researchers keep reporting such flaws.