Before proceeding further, we'd like to advise our dear reader to sit down and perhaps grab a helmet, for this post will elicit quite a few face-palms and forehead-slaps. Two security researchers joined forces and, during early 2026, managed to hack the vehicle connectivity backend infrastructure of two automakers, managing to remotely open the doors on any of their net-connected cars and start their engines across multiple world regions.

The vulnerabilities were quickly fixed, and they pertained to a handful of belief-begging security issues with multiple server APIs that their respective mobile applications use. Furthermore, although remotely opening the cars and starting them were the most concerning bits, the vulnerabilities also exposed the vehicles' location, mileage, fuel, range, door states, and the customers' personal information.

The white-hat hacking duo isn't disclosing the name of the impacted automakers, but they managed to get access to Automaker #1's U.S. vehicles, while vehicles from Automaker #2 were susceptible to unplanned lock disengagement in Australia, the U.S., and Canada. As far as we can tell by visual inspection alone, the second firm may be Toyota, as the hack demonstration video appears to depict a RAV4 SUV.

Both affected automakers use ForgeRock's authentication and authorization services, though with the one small exception, the vulnerabilities found by Shubham Shah and Sam Curry pertained to poor implementations and security practices. One of their writeups goes over the ForgeRock-related affairs in detail for both companies, while Shah's article discusses the specifics on automaker #2 and their Australian connected-car infrastructure.

Source link