All net-connected vehicles from two major automakers allowed hackers to remotely unlock doors and start the engine

Any net-connected vehicle from two automakers could be remotely opened and started - now-patched failures with API backend security showcase a lack of 101-level best practices.

Backend infrastructure failures included hardcoded, user-visible administrator credentials.

Before proceeding further, we'd like to advise our dear reader to sit down and perhaps grab a helmet, for this post will elicit quite a few face-palms and forehead-slaps.

Two security researchers joined forces and, during early 2026, managed to hack the vehicle connectivity backend infrastructure of two automakers, managing to remotely open the doors on any of their net-connected cars and start their engines across multiple world regions.

The vulnerabilities were quickly fixed, and they pertained to a handful of belief-begging security issues with multiple server APIs that their respective mobile applications use.

Furthermore, although remotely opening the cars and starting them were the most concerning bits, the vulnerabilities also exposed the vehicles' location, mileage, fuel, range, door states, and the customers' personal information.

The white-hat hacking duo isn't disclosing the name of the impacted automakers, but they managed to get access to Automaker #1's U.S. vehicles, while vehicles from Automaker #2 were susceptible to unplanned lock disengagement in Australia, the U.S., and Canada.

As far as we can tell by visual inspection alone, the second firm may be Toyota, as the hack demonstration video appears to depict a RAV4 SUV.

Authentication and Researchers

Both affected automakers use ForgeRock's authentication and authorization services, though with the one small exception, the vulnerabilities found by Shubham Shah and Sam Curry pertained to poor implementations and security practices.

One of their writeups goes over the ForgeRock-related affairs in detail for both companies, while Shah's article discusses the specifics on automaker #2 and their Australian connected-car infrastructure.

Exposed Admin Tool and JavaScript Bundle

Shah first decompiled the company's Android application and found network calls to a telematics subdomain, quickly finding an admintool location containing a TEST HARNESS page with a login prompt.

If you haven't been keeping track by now, the first problem is that this endpoint is reachable from the internet at large.

But what really piqued Shah's interest was problem #2: a bundle of JavaScript code that should have been stripped of any unnecessary cruft actually contained the code for the backend's entire functionality, providing a map for further shenanigans.

This alone was enough to grant Shah the ability to pull up customer information with API keys that were hard-coded into said JavaScript.

After some careful chaining of requests and connecting a license plate to a VIN with publicly available info, he connected that to a customer and found their email.

At this point, the team noticed that the automaker was using ForgeRock's authentication mechanisms, and spent "a couple weeks" finding how they were used.

And this is also where they assess that the easiest path to victory is managing to mint an access token for any user, a task made way easier by the "cursed" JavaScript bundle they found at an endpoint containing hard-coded administrator credentials.

These were likely meant for the staging environment, but the duo estimated, correctly, that they could be leveraged nevertheless.

Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.

WAF Bypass and Account Takeover

At this point, they ran into the WAF in front of the service. A Web Application Firewall is similar to a network firewall, but instead of working with IPs and ports, it considers endpoints (URLs) and the requirements to access them.

The researchers hypothesize that although it's a good and standard practice, the WAF was put in place because of how bad things were underneath. And they were right.

The app decompilation had revealed a pinService, and Shah found that it was accessible through the WAF. From thereon, they found getUser, and correctly guessed that they could retrieve users' information with their email, phone, and ID.

Remember those admin credentials? They came in handy, revealing the users' password hashes, but as these were SHA-512, cracking them was unfeasible.

At this point, they let GPT-5.6 Sol Ultra loose to brute-force path names, and found an unprotected one that ultimately let them overwrite any user's password, partially enabling taking over their accounts.

However, there was still MFA to contend with. As it turns out, even that too was misconfigured, as the Australian environment would let users skip MFA entirely.

With some judicious token shuffling across endpoints and the mobile app, they eventually could mint access tokens, letting them fully impersonate any user account... and unlock their cars.

Then, it was as simple as sending out an API request for the door-unlock command, and sure enough, the test car promptly opened.

About the Author

Bruno Ferreira is a contributing writer for Tom's Hardware. He has decades of experience with PC hardware and assorted sundries, alongside a career as a developer.

He's obsessed with detail and has a tendency to ramble on the topics he loves. When not doing that, he's usually playing games, or at live music shows and festivals.