Researchers disclose ForgeRock flaws that allowed car remote control

Security researchers Shubham Shah and Sam Curry have disclosed vulnerabilities in the ForgeRock authentication platform used by two car manufacturers that let them obtain the same remote-control privileges as vehicle owners, according to digitaltoday.co.kr. The findings were published on the 7th.

The researchers said misconfigurations exposed administrator access paths, and some systems retained default admin passwords. That allowed them to bypass normal authentication and reach functions normally reserved for owners.

With owner consent, they tested door unlocking and engine start and stop on vehicles, and were able to view location, mileage and fuel level. In Australia, they found an attack path that identified an owner account by looking up the vehicle identification number from a licence plate, then changing the account password and sending remote commands.

The affected authentication systems were linked to vehicles in the US, Canada, Australia and other regions. The two manufacturers were not named. Community speculation about Toyota and Lexus, based on the demo video, was unconfirmed.

The researchers reported the vulnerabilities in early 2026, and the two companies fixed them and refreshed credentials about two hours after the report.