Security researchers Sam Curry and Shubham Shah say the customer-login servers at two automakers still accepted the default password admin:admin on a hidden administrative console, and that the console was the first step toward unlocking and remote-starting a test car in the United States. Both companies fixed the problem about two hours after being told, according to the researchers’ Nov. 7 write-up. The post does not name either automaker; it calls them Automaker #1 and Automaker #2, at their request.
How a default password reached the door locks
The route ran through the login system that sits between a customer’s phone and the vehicle. The automakers use ForgeRock identity software, the kind of platform that decides whether the person tapping “unlock” in a mobile app is the owner. According to the researchers, a firewall and the server behind it read the same web address differently, so a request the firewall treated as harmless reached an administrative console that was supposed to be blocked. That console was Apache Felix’s web console, which the post says conventionally lives at /system/console, and it accepted admin:admin, a default the post describes as documented.
From there, the researchers say, they used a scheduler feature in the identity platform to run their own code on the server, changed the email address and password on a test customer account, signed in through the normal login flow, and received the same tokens the automaker’s mobile app uses. The post says they tested with a U.S. account and vehicle while the owner stood next to the car. Shah unlocked and started it, then stopped the engine and locked it again.
Picture the owner’s app with nobody holding the phone. The researchers write that the same chain would produce a valid session for customer accounts across the affected deployments, and that for accounts with a connected vehicle the session carries what the owner’s app carries: location and telemetry, door lock and unlock, remote start and stop. They also say the systems served customers in multiple regions but that they tested the full chain only on U.S. accounts and vehicles. Those are the researchers’ findings; neither automaker has been identified, and I found no public statement from either one.
A server-side fix leaves no repair order
Because the fix happened on the automakers’ servers, there was nothing for an owner to bring to a dealer and, as far as the post shows, nothing to tell them. I found no CVE identifier in the write-up. NHTSA’s cybersecurity guidance for vehicle makers, updated in September 2022, calls itself “non-binding and voluntary guidance to the automotive industry.” It tells manufacturers to protect credentials that grant elevated access, to authenticate communication with back-end servers, and to publish a vulnerability-reporting policy. It does not address default passwords directly, and it does not call for notifying owners; its incident-response section points reports toward Auto-ISAC and CISA.
The practical result is that an owner of a connected car cannot tell from the public record whether their automaker was one of the two. The only people who know are the researchers, who chose to withhold the names, and the companies.
Earlier cases follow the same pattern
Curry’s January 2025 Subaru write-up describes an admin panel that gave access to vehicles and customer accounts in the U.S., Canada and Japan, including a year of location history accurate to within 5 meters. He reported it at 11:54 p.m. Central on Nov. 20, 2024, and the post lists the fix at 4:00 p.m. the next day, about 16 hours later. His Kia write-up from September 2024 says a license plate was enough to control key functions of a hardware-equipped car in about 30 seconds, and that owners received no notification that their vehicle had been accessed or their permissions changed. The Kia timeline runs from a June 11, 2024 report to Kia’s August 14, 2024 statement that it had remediated the flaw.
The weakness is also familiar. Login security that was optional is a theme we have covered before: a federal class action alleges that a license plate camera network let officers misuse it for years because strong login security was not required, and a researcher’s work on a BYD Shark 6 was reported to have reached its headlights and microphone remotely. In the Kia and Subaru cases, the public learned of the flaw from the researcher’s own post, after the fix.
Two hours is a fast repair. It also means the only record of two automakers’ exposed login servers is a researcher’s blog post. If the server behind your car’s unlock button once took a default password, would you want the automaker to tell you, even if the fix never touched your car?