Two security researchers say they found flaws in the servers behind two automakers' mobile apps that would let an attacker unlock doors and start engines remotely. Both flaws have been fixed.
Shubham Shah and Sam Curry did the work in early 2026 and have not named the companies. Automaker #1's affected vehicles were in the U.S. Automaker #2's were in Australia, the U.S. and Canada. Beyond unlocking and starting, the researchers said the flaws exposed vehicle location, mileage, fuel, range, door states and customers' personal information.
The step-by-step account covers only automaker #2's Australian system. Shah decompiled its Android app and found a telematics subdomain with an "admintool" page, reachable from the open internet. A JavaScript bundle on the backend contained the service's full functionality, plus hard-coded API keys and administrator credentials, probably meant for a staging environment. A web application firewall (a filter that restricts which URLs can be reached) stood in the way, but a "pinService" endpoint got through it.
The admin credentials exposed password hashes, which were SHA-512 and impractical to crack. The researchers then used an AI model to brute-force path names and found an unprotected one that let them overwrite any user's password. The Australian environment also let users skip multi-factor authentication entirely. That allowed them to mint access tokens, impersonate an account and send a "door-unlock" request, which opened a test car.
The pattern matters more than any single bug. Nobody picked a lock on the car itself. The weak point was ordinary web security: exposed admin pages, secrets shipped in code and a firewall covering for sloppy design underneath. When the phone app is the key, the account system is the lock.
Both automakers use ForgeRock for authentication and authorization. The researchers said that, with one small exception, the problems came from poor implementations rather than the product. That leaves an open question: how many other connected-car backends are configured with the same care?