On 7 November 2026 security researchers Shubham Shah (co-founder of Assetnote) and Sam Curry published two write-ups showing how, starting from nothing more than a car's number plate, they could take over the owner's account in the carmaker's app and send remote commands. The Register reports they could unlock cars, start engines, flash headlights and sound horns. Both automakers used the same identity platform, ForgeRock OpenIDM. The researchers say they tested only on cars they owned or had permission to test.
Australia (Shah's chain): a public number-plate checker gave the car's VIN; internal APIs returned the owner's details and email address; admin credentials for OpenIDM were embedded in a JavaScript bundle — meant for staging, they also worked in production; a path-traversal trick got past the web application firewall that guarded the admin endpoints; and in the Australian environment the multi-factor step could be skipped. With that, Shah could take over an account from its email address, mint app tokens and send the same commands as the official app.
United States (Curry's chain): the researchers say these environments were better hardened and it "required a lot more work". A path-confusion trick reached an Apache Felix admin console that still accepted its factory-default credentials; from there a scheduled Groovy script gave them a shell on the production identity servers, and admin APIs let them read or change owner accounts.
Fixed, and unnamed. According to Curry's disclosure timeline, cited by The Register, the automakers were contacted in early 2026 and patched within two hours of the report. The researchers did not name the carmakers; Curry said "it's a busy time in the security world". Commenters guessed from Shah's demo video that one is Toyota; a Toyota spokesperson neither confirmed nor denied it to The Register. There is no report of anyone else using the flaws.
