Reported by The Register. Security researchers have successfully exploited vulnerabilities in Android applications to gain unauthorized remote access to connected vehicles from two major automakers.
Researchers Shubham Shah and Sam Curry identified exploit paths that allowed them to start engines, flash headlights and sound horns on vehicles in Australia and the United States. The attacks targeted weaknesses in the ForgeRock identity platform used by the manufacturers. In the Australian exploit, the researchers utilized vehicle identification numbers and hardcoded administrative credentials to bypass web application firewalls, eventually minting authentication tokens to issue commands. The U.S. attack involved a more complex method, including exploiting path confusion to access an Apache Felix console and using default credentials to gain shell access to identity servers. These vulnerabilities enabled the researchers to modify user account data and seize control of vehicle functions. The researchers disclosed the findings to the affected companies in early 2026, and patches were deployed within two hours. While the manufacturers remained anonymous, industry observers speculated the vehicles involved were from Toyota and Lexus. The researchers chose to withhold the specific brand names to avoid placing undue strain on security teams during a high-volume period for vulnerability disclosures.
