MediumVulnerabilityResolved· updated Nov 10
Researchers use default admin:admin console on ForgeRock servers to breach two automakers' identity systems, take over accounts and remotely unlock and start cars
Researchers Shubham Shah and Sam Curry disclosed on Nov 7 that in early 2026 they found a vulnerability chain giving them remote code execution on production ForgeRock servers handling customer logins for two unnamed automakers, letting them create a valid session for any customer account and locate, unlock and remotely start connected vehicles .