Two automakers' connected-car backends exposed remote door unlocking and engine start
The flaws also exposed vehicle location and customer personal data, and the researchers said both companies fixed them quickly.
Two security researchers reported that, in early 2026, they gained remote access to the connected-vehicle backends of two automakers, letting them unlock doors and start engines on vehicles in several regions. One automaker's U.S. vehicles were exposed to remote unlocking and engine start, while the other's vehicles in Australia, the U.S. and Canada were susceptible to unplanned lock disengagement, and the flaws also exposed location, mileage, fuel, range, door states and customer personal data. The root causes were poor implementations and weak security practices in server APIs used by the companies' mobile apps, including exposed admin endpoints, hard-coded credentials in client JavaScript, and an unprotected route that let the researchers reset user passwords. The researchers said the issues were quickly fixed, and the second company's Australian environment allowed MFA to be skipped entirely.
Why it matters
The findings show that the risk in connected vehicles can sit in the server software behind the mobile apps rather than in the cars themselves. Owners of affected vehicles were exposed to unlocking and engine start, to unplanned lock disengagement, and to leaks of location and personal details. Because both automakers rely on the same ForgeRock authentication and authorization services, the report also points to a shared dependency that matters beyond these two companies. The root causes were weak server practices, including hard-coded administrator credentials in a JavaScript bundle and an Australian environment that allowed MFA to be skipped entirely.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.