One Default Password Exposed Two Car Brands—and Let Researchers Start Engines

Emily Davis · 2026-11-09

Imagine this: a security researcher types "admin" for both the username and password on a server—and suddenly has the keys to unlock and start cars from two major automakers. That's exactly what happened, and it's a wake-up call for anyone who thinks default credentials are harmless. ### The Flaw That Opened the Door The login systems behind two car brands' mobile apps were built on ForgeRock, an identity platform now part of Ping Identity. On those servers, researchers found something shockingly simple: the default admin credentials—username "admin" and password "admin"—had never been changed. That single oversight gave them full access to the identity servers, which meant they could take over any customer's account. For an owner with a connected car, the implications go far beyond a compromised app. The researchers demonstrated they could unlock the doors and start the engine. No keys, no fob—just a laptop and a guessable password. ### Why This Matters More Than You Think Connected cars are essentially smartphones on wheels. They store personal data, control physical access, and increasingly rely on cloud services. When the identity layer—the system that verifies who you are—is left with factory settings, the entire vehicle becomes a target. Here's what the researchers' findings highlight: - **Default credentials are still a massive problem.** Even in 2024, organizations leave admin panels wide open with the simplest passwords. - **Identity platforms are high-value targets.** ForgeRock (and similar services) manage authentication for millions of users. One misconfiguration can expose every account. - **Physical safety is at stake.** This isn't just about data theft; it's about someone remotely starting your car. > "If a researcher can find this in a few hours, imagine what a motivated attacker could do with weeks of effort." — a sentiment echoed across the security community. ### What Automakers Need to Fix The researchers responsibly disclosed the issue, and the affected brands have likely patched the servers by now. But the incident raises bigger questions. Automakers must treat identity infrastructure with the same rigor as the vehicle's braking system. That means: - Forcing unique, strong passwords on every admin account—no exceptions. - Regularly auditing cloud configurations for default settings. - Implementing multi-factor authentication for all administrative access. ### Your Takeaway as a Consumer If you own a connected car, you can't control the backend servers, but you can protect your account. Use a strong, unique password for your car's mobile app, enable two-factor authentication if available, and keep the app updated. And if you're a developer or IT admin—please, change that default password before someone else does it for you. The lesson here is simple: in a world where our cars are online, the smallest oversight can have the biggest consequences.