Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars
Researchers exploited ForgeRock default credentials and RCE to remotely unlock connected cars at two automakers.
Security researchers discovered a vulnerability chain in ForgeRock Access Management and OpenIDM used by two unnamed automakers, exploiting default admin:admin credentials and URL parsing mismatches to gain remote code execution on production servers. The attack allowed them to access vehicle APIs, unlock cars, start engines, and expose location data. Both automakers patched within two hours of disclosure on November 7, 2026.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ping Identity?
Get an email when a new story names Ping Identity, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited a combination of unchanged default admin:admin credentials and URL parsing mismatches in ForgeRock Access Management and OpenIDM deployed by two automakers, ultimately achieving remote code execution on production identity servers. This gave them direct access to vehicle APIs, enabling remote unlocking, engine starts, and exposure of real-time location data. The incident illustrates how a single failure to change a default password in a production environment — a basic hardening step — can cascade into catastrophic physical-world consequences. It also highlights the danger of deploying identity and access management platforms without thorough post-installation hardening reviews. The fact that both vendors patched within two hours of responsible disclosure underscores how preventable this was with proactive credential management.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Groovy code execution payload