Two Researcher Posts Show ForgeRock Logins at Unnamed Automakers Opening to Vehicle Commands

An attacker who knew a car owner's number plate could, in Australia, turn that plate into a VIN, take over the owner's account on the manufacturer's identity platform and send door-unlock commands to the vehicle, according to a write-up by Assetnote co-founder Shubs dated November 7. A second post the same day, by Shubham Shah and Sam Curry, describes a different route into ForgeRock logins at two automakers that reached account takeover for any customer and, where a vehicle was connected, lock, unlock and engine commands. Neither post names the automaker. Both describe fixes, and neither assigns a CVE.

What the Curry and Shah post describes

Hacking Two Automakers calls the companies "Automaker #1" and "Automaker #2" and says they are unnamed at their request. The chain relied on a parser mismatch across three layers:

1. The edge firewall allowed any path beginning /static, so a request like /static%2f..;/ passed.
2. Jetty decoded the path, stripped the semicolon parameters and resolved the dot segment, which landed on the Apache Felix Web Console (Felix 7.0.1).
3. The console accepted documented default HTTP Basic credentials, and its configuration manager let the researchers create an OpenIDM schedule that ran inline Groovy.

From code execution they read the internal OpenIDM admin credentials from the process environment, changed a customer's email and password, and exchanged the session for mobile app tokens. The post notes that changing the credentials "did not invalidate the account owner's existing app session," and that the mobile OAuth exchange used plain PKCE.

The post also warns that "The API accepting a command did not prove that the car had acted on it," which matters for anyone counting vehicles at risk. Full testing was limited to US accounts and vehicles.

What the Shubs post describes

Shubs' write-up calls the target "the automaker," which sells two brands, and says the Android app shows only "X" as the brand identifier. The post is signed "shubs" and gives no full name; Curry's post credits Shubham Shah, and this report does not assume they are the same person. It credits Curry as co-researcher and says Curry's separate post covers the US, Canadian and European environments. The Australian chain was shorter:

• A "TEST HARNESS" admin tool sat on a public subdomain, and some calls needed only API keys hardcoded in the JavaScript bundle.
• The same bundle held admin credentials for the ForgeRock OpenIDM instance. The author believed they were meant for staging but they worked in production.
• A web application firewall rule blocked /openidm/ paths, and an AI model found a prefix the rule did not cover after manual attempts had failed.
• Admin rights allowed overwriting any user's password, and the Australian environment let a password-based OAuth grant skip multi-factor authentication.

The author writes: "I'm not sure a WAF rule has ever stopped us when we're motivated enough." The attacker needed a number plate, which the post says state registration sites turn into a VIN.

	Curry and Shah	Shubs
Entry point	/static prefix path confusion to Felix console	Hardcoded admin credentials in a JS bundle
Region tested	US accounts and vehicles	Australia, both brands
Dated	Early 2026; sample headers show February 17	Research in July 2026
Vendor fix	Both fixed within about two hours	Not stated

What the two posts do not settle

The timelines disagree, so the posts may describe different chains or different dates. Curry and Shah date their work to early 2026 and say both automakers fixed the issue within about two hours of the report. Shubs dates the joint work to July 2026 and gives no report or fix date. Nothing in either post says the automaker in one is the automaker in the other, or that the Australian flaw was patched.

Neither post lists a CVE, so the entries will not appear on vulnerability trackers. Neither says how many vehicles were reachable, and neither reports exploitation by anyone else. Both are researcher accounts of their own findings, with no manufacturer statement in either.

What defenders can take from it

The common failure is a firewall rule written against a path string while the application server normalises the path differently. Fixes the posts imply: take admin consoles off the public edge, remove default and staging credentials from client bundles, and enforce MFA consistently across regional environments. For the model-assisted part of the Australian chain, compare the claims in the site's report on OpenAI's GPT-6 Cyber, and for how quickly a published flaw becomes an obligation, see CISA's listing of an Apple flaw.