Search advisories

Researchers Shubham Shah and Sam Curry disclosed on Nov 7 that in early 2026 they found a vulnerability chain giving them remote code execution on production ForgeRock servers handling customer logins for two unnamed automakers, letting them create a valid session for any customer account and locate, unlock and remotely start connected vehicles .