Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars

Researchers used default admin:admin credentials as part of a vulnerability chain that let them run code on two automakers’ production ForgeRock servers and remotely unlock connected cars.

Found in early 2026 and disclosed on November 7, the flaws also exposed vehicle locations and supported remote engine commands.

The findings came from controlled security research, not a reported criminal campaign. Both unnamed automakers fixed the issue within about two hours of receiving the report and rotated affected credentials. Their identity systems served multiple regions, but the researchers tested the complete account takeover and vehicle access chain only with US accounts and vehicles.

ForgeRock Attack Chain

The investigation began with the Android apps used by vehicle owners. Both apps relied on ForgeRock Access Management for login sessions and OpenIDM for customer records. Tracing an email validation request led the researchers toward administrative services, including the Apache Felix Web Console running alongside OpenIDM.

A web application firewall blocked direct requests to those services. However, specially encoded paths made requests appear to target static files while Jetty, the backend web server, interpreted them as console requests. This mismatch in URL handling exposed the hidden management interface, where the documented default username and password still worked.

Access to Felix’s ConfigMgr interface allowed the researchers to create an OpenIDM scheduled task that ran Groovy code. They used it to install a small Java component inside the running service, giving them a controlled command endpoint. This confirmed remote code execution within the production identity process rather than inside the cars themselves.

From Server Access to Vehicle Commands

According to the researchers’ technical report, server access exposed administrative credentials that allowed local requests to customer records. The team changed a test account’s email and password, received its verification codes, and completed the normal login process. They then exchanged the session for tokens accepted by the vehicle APIs.

Those tokens exposed the account’s vehicles, location, status, and supported remote controls. With the owner beside the test vehicle, Shah confirmed unlocking, engine start, engine stop, and locking.

Restoring the original email did not cancel the new tokens. The findings follow earlier Kia remote access research and Subaru STARLINK security flaws.

Ping Identity’s production hardening guide already advises removing or protecting the Felix console and changing its default credentials. It also warns that console authentication is separate from IDM authentication. The case shows why blocking administrative URLs at a firewall cannot replace securing the service behind it, especially when that service controls customer identity and access to connected vehicles.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars appeared first on Cyber Security News.