> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Default 'admin' Password Let Hackers Unlock Cars
- URL: https://blog.harshkohli.com/car-app-default-admin-password-unlock/
- Published: 2026-11-09T15:56:28.000Z
- Updated: 2026-11-09T15:56:28.000Z
- Description: Researchers took over two car makers' login servers via a ForgeRock console left on admin:admin, then unlocked and started cars. What owners can check.
- Author: Harsh Kohli
- Tags: Tech News, Software

Two security researchers have shown that they could take over customer accounts at two car makers and, from there, unlock and start those customers' cars from a phone. The way in wasn't some clever new flaw. It was an admin console on the companies' login servers that still used its factory password, which was simply `admin`.

## What happened

Sam Curry and Shubham Shah published the details on 7 November on [Curry's blog](https://samcurry.net/forgerock?ref=blog.harshkohli.com). The work dates from early 2026\. Both car makers used ForgeRock, identity software now owned by Ping Identity, to sign customers into their connected-car apps. One part of that software, OpenIDM, stores customer records and ships with a separate admin console. ForgeRock's own hardening advice says to remove or lock down that console before going live. On these servers it was still there, still on the default login, and the pair found a way to slip past the web filter that was meant to hide it.

From the console they could run their own code on the server, change a customer's email and password, and sign in through the normal app. That gave them the same powers the owner's app has: the car's location, door lock and unlock, and remote engine start. They tested the full chain only on US cars they owned or had permission to use, with an owner standing next to the vehicle. Both car makers fixed it about two hours after the report and changed the exposed credentials. The companies asked not to be named, and the researchers agreed.

Shah also wrote up a [second chain against the same maker's Australian systems](https://shubs.io/unlocking-any-car-from-x-brand-in-most-of-the-world/?ref=blog.harshkohli.com), where admin credentials had been left inside the app's code. Combined, he says, they could send unlock and start commands to that maker's cars in Australia, the US and Canada. That post doesn't say when the Australian side was fixed. [The Hacker News](https://thehackernews.com/2026/11/default-adminadmin-server-password.html?ref=blog.harshkohli.com) notes there's no CVE or vendor advisory, since this was a setup mistake rather than a bug in the product.

## Why it matters

Car apps are now car keys. If the server behind the app falls, every car tied to it is exposed, no matter how careful the owner is. The researchers also point out that the attack left very little for an owner to notice: changing the account's email didn't log the real owner out, and alerts could be pointed to the attacker's phone. Neither write-up says whether anyone else found this path before it was closed.

## What to do

There's nothing to patch on your side, since the holes were on the car makers' servers. But a few habits help with any connected car:

- Open your car's app and check the account email and phone number are still yours.
- Look for secondary drivers or linked devices you don't recognise, and remove them.
- Turn on notifications for remote unlock and engine start, so a command you didn't send gets your attention.
- Use a unique password for the car account, and turn on two-step sign-in if the app offers it.
- If you never use remote features, ask your dealer or the app whether you can switch them off.

If you run identity systems at work, check for the Apache Felix console at `/system/console` on any ForgeRock or PingIDM server, and don't rely on firewall path rules alone to hide admin pages.

## My take

What gets me is that this was a documented default password, not some exotic exploit. The same two researchers have found similar holes at Honda, Kia and Subaru before, so this isn't a one-off; it's how the industry builds these apps. Plenty of new cars sold in India also come with a connected app, and the same server-side risk comes along with them. A two-hour fix is great. I'd still like car makers to name themselves when it happens, so owners can decide for themselves whether to check their accounts.

Account takeovers usually start with a company's servers rather than your phone, as the [Capcom ID breach](https://blog.harshkohli.com/capcom-id-data-breach-11-million/) showed. For another case of a login check being bypassed, see our post on the [OpenSSH password bypass on Alpine](https://blog.harshkohli.com/openssh-musl-alpine-password-bypass/).