The Default admin:admin Password That Unlocked Two Automakers' Cars

Two automakers' mobile apps signed customers in through ForgeRock (now Ping Identity). On those servers, an administrator console still used its documented default password: admin / admin.

Researchers Shubham Shah and Sam Curry used the flaw to take over any customer account — and, for connected cars, to unlock the doors and start the engine in tests run in February 2026 on consenting owners' cars. Both systems were fixed about two hours after the report.

The Chain

The identity platform runs in two parts: one for login, and OpenIDM, which holds customer records. OpenIDM ships a built-in administrator console powered by the Apache Felix tool. ForgeRock's own hardening guide tells operators to remove this console or protect it before going live, because it stores its password separately. On these servers it was still there — with the username and password both the word admin.

The console was blocked from the open internet, but the edge and the Java server behind it read the same URL differently. By adding encoded slashes and extra characters, the researchers made the edge treat the request as a harmless static file while the server treated it as the console path. The default password did the rest. Full method: Sam Curry's technical analysis.

Inside the console they used a built-in scheduler to run code on the identity server, gaining a command prompt on the machine holding both brands' customer records. From inside, they changed a target account's email and password, signed in through the normal app, and received the tokens the real app uses — the keys to the car. They unlocked doors and started the engine of a test car, owner standing beside it, then stopped it.

A second attack on the Australian systems used admin credentials left in the app's code for a test setup (Australia chain). Both together reached vehicles in Australia, the US, and Canada.

What Identity Teams Should Do

There is no CVE here — the mistake was in how the platform was run, not a new product bug. Two checks for PingIDM (ForgeRock) deployments:

• Look for the Apache Felix console at /system/console and remove it, or change its default password.
• Do not trust edge/WAF path rules to hide admin pages — a path the edge and the server read differently slips past the rules.

The researchers also left almost no trace for owners: changing email/password did not log the owner out, and alerts could be redirected to the attacker's phone. They restored the real email after testing.

Verifying the Fix in Your Own ForgeRock Deployment

After removing /system/console, confirm the remediation actually held: re-request the console path from outside the network to check the edge no longer resolves it, re-authenticate an admin user and confirm the default password no longer logs in, and search the app package for any hardcoded test credentials — the Australian path shows how often the "default password" is actually just a shipped dev account. Then scan for encoded-slash variants in WAF logs; the bypass technique leaves traces that a plain path audit misses. A fix nobody verified is a hope, not a control.

Sources

• The Hacker News coverage
• Sam Curry technical analysis
• Shubs Australia chain write-up
• PingIDM hardening guide