Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars

A credential leak at Automakers Unlock is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.

The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine.

Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an administrator console that still used its default password.

They tested the full attack only on their own and consenting owners' cars in the United States, in February 2026, and both systems were fixed about two hours after they reported the problem.

They reported being able to open a session for any customer account on the affected servers, but they ran the vehicle commands only on cars they owned or were allowed to use.

Neither write-up says whether anyone else found or used the path before it was closed.

Anyone connected to Automakers Unlock through the compromised trust relationship is potentially affected, not just Automakers Unlock itself.

They had started with the apps: both brands signed customers in through the same platform, which runs in two parts: one for login and one, called OpenIDM, that holds customer records.

ForgeRock's own hardening guide tells operators to remove this console or protect it before going live because it stores its own password separately from the rest of the system.

A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.

Inside the console, the researchers used a built-in scheduler to run small scripts that execute their own code on the identity server.

They changed a target account's email address and password, signed in as that customer through the normal app, and received the same access tokens the real app uses.

The trust mechanism involved here is an OAuth or access token, which is what let access move between otherwise unrelated systems.

By adding encoded slashes and extra characters, the researchers made the edge treat the request as a harmless static file while the server treated it as the path to the console, and the default password did the rest.

That gave them a command prompt on the machine that holds the customer records for both brands' logins.

Automakers Unlock says the credential has been revoked, and no exploitation has been confirmed so far.

The console was blocked from the open internet, but the edge that guards the site and the Java software behind it read the same web address differently.

The records sat behind the same block as the console, but the researchers' code reached them from inside the server.

If you have any integration or dependency involving Automakers Unlock, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.

For teams running the same identity software, now sold as PingIDM, two checks matter: The two researchers have a long record of this kind of work, usually breaking into the web systems behind the apps rather than the cars themselves.