Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars

Security researchers Shubham Shah and Sam Curry discovered that two automakers' mobile apps used ForgeRock's identity platform with the default admin credentials 'admin:admin' still in place on production servers. By exploiting a path confusion vulnerability, they bypassed edge protections to access the Apache Felix administrative console, execute code, and gain full control over customer accounts. This allowed them to modify account details, obtain valid access tokens, and remotely unlock and start vehicles belonging to consenting owners in the U.S. A second attack vector in Australia involved hardcoded admin credentials in the app code, enabling similar access across multiple regions including Canada.

AI-extracted · verify before operational use