Shubham Shah and Sam Curry published connected-car security research on November 7, 2026, describing how compromised identity systems let them unlock vehicles through manufacturers' own app services. Their joint report covers two unnamed automakers. The reported attacks reached the systems managing customer accounts, then used that access to obtain permission to issue vehicle commands.
That report says both automakers fixed the vulnerability within about two hours of receiving it and rotated affected credentials. The researchers say they found the chain in early 2026 and reported it before publication. MrKeyoor has not independently tested the attacks or verified the fixes.
An Australian chain started in browser code
In Shah's Australian account, a vendor JavaScript bundle exposed administrator credentials for OpenIDM, the system managing customer identities. Credentials intended for staging also worked in production, he reports. A web application firewall blocked sensitive routes, but an encoded path reached the identity APIs.
The researchers could then change a customer's password. Shah says a separate authentication-flow misconfiguration let them bypass multi-factor authentication (MFA) and obtain an app token. Sending an unlock request opened the doors on a test vehicle. He says testing involved cars they owned or had permission to access.
The practical lesson is that a review of the consumer login screen also needs to account for the administrative systems that can change customer identities.
The US demonstration had a different route
The joint write-up describes reaching the Apache Felix administration console, which manages components running inside OpenIDM, through inconsistent URL handling. The researchers report that the console accepted default credentials and let them configure a script to run inside the identity process. They say control of the affected identity servers let them create valid customer sessions, which provided the vehicle access available through the owner's app.
They say the complete chain was tested only with US accounts and vehicles, despite identity access spanning multiple regions. Infrastructure reach does not establish that the complete vehicle-command chain worked in every region.
The console needs its own protection
Ping Identity's IDM 7.2 production-hardening guidance says to remove or protect the Felix console and explains that its authentication is separate from IDM authentication. It also instructs administrators who retain the console to change its credentials. For developers reviewing a similar deployment, those are specific checks to make alongside tests of how the firewall and application interpret encoded URLs. The documentation version does not establish which IDM version the automakers deployed.
The automakers remain unnamed in the joint report, so owners cannot identify an affected model from it. Further manufacturer disclosure would need to establish which services were affected and what remediation covered. The reported fixes and testing limits belong alongside any account of the car unlocks.