Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
Summary: Security researchers Shubham Shah and Sam Curry took over the login systems behind two car brands' mobile apps after finding an OpenIDM administrator console still protected by the documented default password of admin for both username and password. By adding encoded slashes and extra characters, they made the edge treat requests as static files while the Java server read them as the console path, then used a built-in scheduler to run code, reset a customer's email and password, and unlock and start a test car; both systems were fixed about two hours after they reported the problem in February 2026.
Bottom line: The brands' exposure came from how they ran ForgeRock, not a product bug, so there is no CVE and no vendor advisory to track - and the same default console and password have been documented for years, with the maker's own hardening guide telling operators to remove or protect it before going live.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026