TechCapsules

AI-summarised brief · reviewed before publication

Security researchers Shubham Shah and Sam Curry discovered that two automakers’ mobile‑app login systems, built on ForgeRock’s identity platform, retained a default “admin:admin” console password. By exploiting a path‑parsing flaw, they bypassed the edge firewall, accessed the Apache Felix‑based administrator console, and used its scheduler to run code on the identity server that stored customer records. They then altered a target account’s credentials, obtained valid access tokens, and remotely unlocked and started a test vehicle in the United States, repeating the full chain on consenting owners’ cars. The flaw was reported and patched within two hours. A separate analysis showed a similar vulnerability in the brands’ Australian systems, where test credentials were hard‑coded in the app. Both incidents expose any user’s account and connected‑car functions to remote takeover.