islami haberdini haberortadoğu haberleriislam coğrafyası
DOLAR
50,2292
EURO
56,1322
ALTIN
6.515,48
BIST
11.661,86
Adana Adıyaman Afyon Ağrı Aksaray Amasya Ankara Antalya Ardahan Artvin Aydın Balıkesir Bartın Batman Bayburt Bilecik Bingöl Bitlis Bolu Burdur Bursa Çanakkale Çankırı Çorum Denizli Diyarbakır Düzce Edirne Elazığ Erzincan Erzurum Eskişehir Gaziantep Giresun Gümüşhane Hakkari Hatay Iğdır Isparta İstanbul İzmir K.Maraş Karabük Karaman Kars Kastamonu Kayseri Kırıkkale Kırklareli Kırşehir Kilis Kocaeli Konya Kütahya Malatya Manisa Mardin Mersin Muğla Muş Nevşehir Niğde Ordu Osmaniye Rize Sakarya Samsun Siirt Sinop Sivas Şanlıurfa Şırnak Tekirdağ Tokat Trabzon Tunceli Uşak Van Yalova Yozgat Zonguldak
İstanbul
Parçalı Bulutlu
13°C
İstanbul
13°C
Parçalı Bulutlu
Çarşamba Çok Bulutlu
17°C
Perşembe Çok Bulutlu
20°C
Cuma Çok Bulutlu
20°C
Cumartesi Yağmurlu
19°C

“Admin” password enabled remote access to two car brands

Researchers remotely unlocked cars and started their engines during authorized tests involving two brands. The flaw tested in the US was fixed the day it was reported.

“Admin” password enabled remote access to two car brands
General News
Mirat Haber
11/11/2026 01:40
A+
A-

Cybersecurity researchers Shubham Shah and Sam Curry exploited flaws in two car brands’ mobile app infrastructure to unlock vehicles and start their engines during authorized tests in the United States. According to NTV’s report, sourced from Anadolu Agency, tests in February 2026 found that the administration panel accepted the default username and password “admin”. The access also extended to vehicle locations and the remote-control functions available through the apps.

Key findings from the investigation

  • Both manufacturers used ForgeRock’s identity management infrastructure for mobile app logins.
  • The researchers withheld the brands’ names at the companies’ request.
  • Full attack tests in the United States were conducted only on cars whose owners had given permission.
  • Both manufacturers fixed the flaw tested on vehicles on the day it was reported and replaced the affected credentials.

Researchers reached an administration panel behind a firewall

According to the researchers’ report, a firewall blocked direct access to the administration panel. However, differences in how the firewall and server interpreted the same web address allowed them to bypass that restriction. The panel they reached accepted “admin” as both the username and password.

These credentials belonged to the infrastructure’s administration panel, not the vehicle owner’s personal account. After gaining access to the server, the researchers changed the email address and password of an authorized test account and opened a new session in the mobile app.

Security guidance from Ping Identity, which owns the platform, recommends removing this panel from production systems or securing it by changing its credentials. Viewed alongside those recommendations, the configuration described in the report shows that the administration panel’s security was central to the incident.

What did this mean for vehicle owners?

During the authorized test, changing the account’s email address and password did not end the existing session on the vehicle owner’s phone. The researchers were nevertheless able to access the vehicle’s location and the app’s supported remote-control functions through their new session. This showed that commands could be sent from another session on the same account while the owner remained logged in.

Shah unlocked the doors and started the engine while the owner was beside the car. The test demonstrated more than access to account information: the app’s physical vehicle functions could also be used. The fix implemented after the report closed the flaw tested on the vehicles and replaced the affected credentials.

The Australian finding involved a different route to access

In a separate report, Shah said administrator credentials created for a test environment had been embedded in a JavaScript file in an Australian system. The same credentials were found to work in the system serving customers. Using this method, the researchers unlocked an authorized test vehicle.

Shah says the two investigations together showed that remote commands could be sent to connected vehicles in the United States, Canada and Australia. However, the engine start described in the US tests and the door-unlocking test in Australia are separate findings. The public reports do not state when the Australian flaw was fixed or whether anyone other than the researchers used these methods.

What has been disclosed, and what remains unclear?

Which car brands were affected?

The two brands were not named. The researchers withheld that information at the companies’ request.

Have all the flaws been fixed?

Both manufacturers fixed the flaw tested on vehicles in the United States on the day it was reported and replaced the affected credentials. The public reports did not state when the separate Australian flaw was fixed.

Related coverage

Comments

No comments yet, be the first filling the form below.