Automaker Apps Compromised by Default Admin Password

On Nov 9 researchers discovered that login systems behind two car brands' mobile apps could be compromised entirely because the servers used default 'admin:admin' credentials. They accessed every customer's account and, for owners whose vehicles were connected, unlocked doors and started engines remotely. Both apps authenticated users via ForgeRock, an identity platform now part of Ping Identity; the researchers reached the servers at ¹.

Use of default credentials in identity platforms like ForgeRock has been a recurring security failure; similar issues surfaced with MongoDB instances around 2017. The flaw allows attackers to manipulate vehicle systems remotely if connected services are enabled.

Attackers could sell customer data on dark‑web marketplaces or extort owners by leveraging stolen car keys until they receive payment through cryptocurrencies logged on immutable ledgers.

This incident underscores the urgent need for automakers to adopt zero‑trust architectures and rotate default credentials proactively.