Connected cars from two major automakers could be hacked to unlock doors and start engines remotely

Two security researchers exploited backend flaws in connected-car systems, allowing them to remotely unlock doors and start the engine on vehicles from two major automakers.

Connected-car infrastructure at two automakers breached

In early 2026, security researchers Shubham Shah and Sam Curry breached the backend infrastructure that powers vehicle connectivity at two major automakers. As a result, they could unlock the doors of any internet-connected vehicle remotely. They were also able to start engines in multiple regions around the world.

The flaws were patched quickly. They sat in several server APIs used by the automakers' mobile apps. Beyond unlocking doors and starting engines, the systems exposed vehicle location, mileage, fuel level, remaining range, door status, and customers' personal information. The researchers have not named the automakers. Vehicles from the first were affected in the US. Vehicles from the second were affected in Australia, the US, and Canada.

From an Android app to customer data

Shah began by decompiling the second automaker's Android app. He found network calls to a telematics subdomain, including an "admintool" path with a "TEST HARNESS" page that required a login. Notably, anyone on the internet could reach this page.

The second problem was more serious. A JavaScript bundle that should have been stripped of unused code instead contained the entire backend's functionality. It also included a hard-coded API key. With it, the team could retrieve customer data. They matched license plates against VINs from public sources, then traced each one to the customer and that person's email address.

Both automakers use ForgeRock's authentication and authorization services. However, apart from one minor exception, the flaws came from poor implementation and weak security practices rather than the platform itself. The team spent several weeks working out how the automakers used ForgeRock. Their goal was to mint an access token for any user. The same JavaScript bundle also contained hard-coded admin credentials. These likely belonged to a staging environment, but the team guessed correctly that they would still work.

Bypassing the WAF and MFA

Next, the team ran into a web application firewall (WAF). A WAF works by endpoint (URL) and access conditions, rather than by IP and port like a network firewall. The researchers suggested the automaker deployed a WAF because the underlying infrastructure was too weak. They found a "pinService" that passed through the WAF, followed by a "getUser" endpoint that returned user information by email, phone number, or ID. The admin credentials let them see users' password hashes. However, the hashes used SHA-512, so cracking them was not feasible.

The team then used an AI model to brute-force paths. They found an unprotected path that allowed them to overwrite any user's password. That left the MFA layer. The Australian environment was also misconfigured, allowing users to bypass MFA entirely. After rotating tokens between endpoints and the mobile app, the team generated an access token. From there, they could fully impersonate any account. Finally, they sent a "door-unlock" API request to a test vehicle. The car unlocked immediately.

Source: Tom's Hardware

Reviewed by: Hero Association