Researchers use default admin:admin console on ForgeRock servers to breach two automakers' identity systems, take over accounts and remotely unlock and start cars

Researchers Shubham Shah and Sam Curry disclosed on Nov 7 that in early 2026 they found a vulnerability chain giving them remote code execution on production ForgeRock servers handling customer logins for two unnamed automakers, letting them create a valid session for any customer account and locate, unlock and remotely start connected vehicles ^[1]. The Hacker News reports that the Apache Felix admin console on those servers still used the documented default admin:admin credentials, and the researchers bypassed edge blocking by exploiting differences in how the edge and backend parsed URLs ^[1][2]. Both automakers fixed the issue about two hours after the report and rotated affected credentials; teams running ForgeRock (PingIDM) should check for the /system/console console and remove it or change its default password ^[1][2].

Industries mainly affected: Transportation & logistics

Both automakers fixed the issue about two hours after the report and rotated affected credentials; teams running ForgeRock (PingIDM) should check for the /system/console console and remove it or change its default password