Researchers unlocked and started cars by guessing a server password

Two security researchers got into the login systems behind two car brands' mobile apps by typing the word "admin" as both the username and the password. From there they could open any customer's account and, for owners with a connected car, unlock the doors and start the engine. Both brands fixed the problem about two hours after being told.

What happened

Shubham Shah and Sam Curry found that both apps signed customers in through ForgeRock, an identity platform now owned by Ping Identity. It checks who you are when you log in. One part of it holds customer records, and that part includes an administrator console. The maker's own guide says to remove that console or lock it down before going live. On these servers it was still there, with its factory password.

How they got in

The console was supposed to be closed to the public internet. The researchers got around that by writing the web address in a way that fooled the site's front gate into treating it as a harmless file. Once inside, they ran their own code on the server, changed a target account's email and password, and signed in as that customer. The app then gave them the same digital keys it gives real owners. With those, they unlocked a test car and started its engine while the owner stood beside it.

Why it is hard to spot

Changing the email and password did not log the real owner out of the app. The researchers could also send the account's alerts to their own phone, so the owner would see nothing. They restored the real email address after testing. Neither write-up says whether anyone else found or used the same path before it was closed.

Who it affects

The researchers say they could send unlock and start commands to cars in the United States, Canada and Australia. They tested the full attack only on US cars they owned or had permission to use, in February 2026. A second attack on the Australian systems used a different route: admin logins left in the app's code from a test setup. No fix date is given for Australia. The two brands are not named, so owners cannot tell from the story whether their car is involved.

What to do

The weakness was on the companies' servers, so owners could not have prevented it. They can still make an account harder to misuse and catch trouble early. The alert box above lists the steps, including what to check if your business runs this login software.

What happens next

This was a setup mistake, not a new flaw in the product, so there is no official flaw number and no vendor advisory to follow. The default password has been documented for years. The same researchers have shown remote access to Honda, Kia and Subaru vehicles, usually by breaking into the web systems behind the apps rather than the cars. Expect more of these stories.