Connected Car Admin Platform Exposed, Enabling Mass Unlocks

A security researcher reverse-engineered a major automaker’s mobile app to discover the backend admin infrastructure relied entirely on hardcoded API keys embedded in JavaScript bundles. By chaining several poorly-authenticated APIs, the researcher could convert a vehicle’s number plate into the owner’s complete account details by following this path: plate → VIN → subscriber GUID → email address and personal information.

More critically, admin credentials for the automaker’s ForgeRock OpenIDM identity system were hardcoded in another exposed JavaScript bundle. Possession of these credentials would grant the ability to issue authentication tokens for any user account and remotely control connected vehicles—unlocking, locking, sounding the horn, or controlling the engine. While the identity endpoints were protected by WAF rules, the researcher was investigating path traversal techniques to circumvent these protections.

The chain of vulnerabilities reveals systemic architectural failures: publicly exposed admin infrastructure, hardcoded credentials scattered across multiple application bundles, APIs with minimal authentication requirements, and security defenses applied via WAF rules rather than fundamental access control redesign.