// TOM'S HARDWARE US — HARDWARE & GADGET
All net-connected vehicles from two major automakers allowed hackers to remotely unlock doors and start the engine
Backend infrastructure failures included hardcoded, user-visible administrator credentials.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Before proceeding further, we'd like to advise our dear reader to sit down and perhaps grab a helmet, for this post will elicit quite a few face-palms and forehead-slaps. Two security researchers joined forces and, during early 2026, managed to hack the vehicle connectivity backend infrastructure of two automakers, managing to remotely open the doors on any of their net-connected cars and start their engines across multiple world regions.
The vulnerabilities were quickly fixed, and they pertained to a handful of belief-begging security issues with multiple server APIs that their respective mobile applications use. Furthermore, although remotely opening the cars and starting them were the most concerning bits, the vulnerabilities also exposed the vehicles' location, mileage, fuel, range, door states, and the customers' personal information.
The white-hat hacking duo isn't disclosing the name of the impacted automakers, but they managed to get access to Automaker #1's U.S. vehicles, while vehicles from Automaker #2 were susceptible to unplanned lock disengagement in Australia, the U.S., and Canada. As far as we can tell by visual inspection alone, the second firm may be Toyota, as the hack demonstration video appears to depict a RAV4 SUV.
Both affected automakers use ForgeRock's authentication and authorization services, though with the one small exception, the vulnerabilities found by Shubham Shah and Sam Curry pertained to poor implementations and security practices. One of their writeups goes over the ForgeRock-related affairs in detail for both companies, while Shah's article discusses the specifics on automaker #2 and their Australian connected-car infrastructure.
Shah first decompiled the company's Android application and found network calls to a telematics subdomain, quickly finding an "admintool" location containing a "TEST HARNESS" page with a login prompt. If you haven't been keeping track by now, the first problem is that this endpoint is reachable from the internet at large. But what really piqued Shah's interest was problem #2: a bundle of JavaScript code that should have been stripped of any unnecessary cruft actually contained the code for the backend's entire functionality, providing a map for further shenanigans.
This alone was enough to grant Shah the ability to pull up customer information with API keys that were hard-coded into said JavaScript. After some careful chaining of requests and connecting a license plate to a VIN with publicly available info, he connected that to a customer and found their email. At this point, the team noticed that the automaker was using ForgeRock's authentication mechanisms, and spent "a couple weeks" finding how they were used.
And this is also where they assess that the easiest path to victory is managing to mint an access token for any user, a task made way easier by the "cursed" JavaScript bundle they found at an endpoint containing hard-coded administrator credentials. These were likely meant for the staging environment, but the duo estimated, correctly, that they could be leveraged nevertheless.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.