Researchers found that a vulnerability chain in ForgeRock identity systems let them run code on two automakers’ production servers and unlock connected cars remotely. The work was part of controlled security research, not a criminal campaign, and the issue was fixed within about two hours after both unnamed automakers received the report.
ForgeRock attack chain in production systems
The investigation started with the Android apps used by vehicle owners. Both apps used ForgeRock Access Management for login sessions and OpenIDM for customer records. An email validation request led the researchers toward administrative services, including the Apache Felix Web Console running beside OpenIDM. A web application firewall blocked direct requests to those services, but specially encoded paths made the requests look like static files while Jetty interpreted them as console requests.
That mismatch exposed the hidden management interface, where the documented default username and password still worked. Once inside Felix’s ConfigMgr interface, the researchers created an OpenIDM scheduled task that ran Groovy code. They used that to install a small Java component inside the running service and build a controlled command endpoint. The result was remote code execution inside the production identity process, not inside the cars.
From account takeover to vehicle control
According to the researchers’ technical report, server access exposed administrative credentials that allowed local requests to customer records. The team changed a test account’s email and password, received its verification codes, and completed the normal login flow. They then exchanged the session for tokens accepted by the vehicle APIs.
Those tokens revealed the account’s vehicles, location, status, and supported remote controls. With the owner beside the test vehicle, Shah confirmed unlocking, engine start, engine stop, and locking. Restoring the original email did not cancel the new tokens.
Earlier research and vendor guidance
The findings follow earlier Kia remote access research and Subaru STARLINK security flaws. Ping Identity’s production hardening guide already advises removing or protecting the Felix console and changing its default credentials. It also says console authentication is separate from IDM authentication.
The case shows that blocking administrative URLs at a firewall does not replace securing the service behind it. That matters when the service controls customer identity and access to connected vehicles. The identity systems served multiple regions, but the researchers tested the full account takeover and vehicle access chain only with US accounts and vehicles.
Licensed under CC BY-ND 4.0 International