This is my security story of the day, and it has everything: a WAF bypass, a hidden admin console, a default password, and a car that starts when someone who isn't the owner says so.
On November 7, researchers Sam Curry and Shubham Shah published how they got into the production identity servers of two automakers (they don't name them) and used that access to take over owners' accounts and send remote commands to vehicles. Both automakers fixed it, according to the researchers, "within about two hours" of the report.
The Chain, Step by Step
The identity platform here is ForgeRock (now part of Ping Identity), which handles login for the automakers' mobile apps. Per the researchers' write-up:
- Path confusion past the WAF. The edge blocked admin paths like
/system/console. A carefully encoded request slipped past the edge, and the server behind it decoded the same request into the admin console. Two components, two opinions about what a URL means. - A default password. The Apache Felix Web Console was sitting there behind HTTP Basic auth with
admin:admin. It worked. - Code execution. Through the console's configuration manager, they created a scheduled task that runs Groovy, and used it to load their own component. Now they had commands running inside the identity server.
- Internal admin credentials. From the process environment they pulled the identity admin credentials and used them against the internal API on localhost, where the WAF wasn't watching at all.
- Account takeover. They changed a test customer's email and password, completed the app's normal login with a code sent to their own mailbox, and got valid tokens.
- The car. With those tokens, the vehicle API accepted unlock, engine start and the rest. They ran the commands with the owner standing next to the car.
The researchers say they tested the full chain only with US accounts and vehicles. The Hacker News also reports a separate path the same team found on Australian systems, where admin credentials for a test setup were left in the app.
This Isn't a ForgeRock Bug
No CVE, no vendor advisory. The Hacker News put it this way: "The brands' mistake was in how they ran ForgeRock, not a new bug in the product." ForgeRock's own hardening guidance says to remove or protect that console in production. Every identity platform, Zscaler's included (I work there), can be deployed badly. The lesson is about how the thing was run.
Three Things I'd Take From This
1. Your identity provider is your crown jewel. We talk about identity as the new perimeter, and it's true. Which means the IdP itself needs the same paranoia we used to reserve for the firewall. Here, owning the login server meant owning every customer account it managed.
2. A WAF rule is not access control. "We block /system/console at the edge" is a hope, not a control. If the admin interface exists and listens, someone will find the encoding that gets there. The fix is for the admin console to not be reachable at all, or not exist in production.
3. Default credentials are still the cheat code. This is the second story today where admin:admin-style defaults did the heavy lifting (the other is the Operation Snowball AI agent). In 2026. On production systems. Attackers, human or AI, check these first because they keep working.
What To Do
- Look for admin consoles on your identity stack. If you run ForgeRock or PingIDM, check whether
/system/consoleexists in production, and remove it or change its credentials and lock it down. - Don't let internal APIs trust localhost. Require auth for admin APIs even from the same box.
- Normalize paths before security decisions, and test your WAF with encoded and path-parameter variants.
- Re-verify on email and password changes for customer accounts, and invalidate existing sessions and tokens when they change.
- Inventory every default credential on management planes, including the ones buried inside third-party components.
Bottom Line
The cars weren't hacked. The login server was, and the cars believed it. When identity is the perimeter, a forgotten admin console with a factory password is a hole in the whole thing.
Sources: Sam Curry and Shubham Shah, The Hacker News, Cyber Security News