ForgeRock flaws let researchers remotely unlock and start cars from two automakers

Security researchers Shubham Shah and Sam Curry reported vulnerabilities in the systems of some automakers that made it possible to unlock car doors and start engines remotely, according to gigazine.net on 10 November 2026 gigazine.netgigazine.netgigazine.netOpen source ↗. The researchers examined ForgeRock, an authentication system used by automakers, and found several vulnerabilities in it. The names of the manufacturers were not disclosed. Modern cars let owners lock, unlock and start the vehicle from a smartphone, so a flaw in the connecting system can hand control to a third party.

ForgeRock flaws in Australia and the US

According to Shah, in Australia a vehicle identification number could be looked up from a license plate, which allowed the owner's account to be identified. Exploiting a vulnerability in the authentication system, the researchers could also change the password and control the vehicle remotely.

Curry and colleagues found a vulnerability in an authentication system in the United States. By executing unauthorized code on a server, they could unlock doors, start and stop the engine and obtain location data, they reported. The team said commands could be sent to vehicles in Australia, the United States and Canada. Which functions actually worked depended on the model and the service subscription.

Disclosure and affected manufacturers

The researchers did not name the manufacturers. On the engineering news site Hacker News, commenters suggested Toyota and Lexus, noting that the vehicle in the verification video resembles a Toyota RAV4. This had not been confirmed at the time of writing gigazine.netgigazine.netgigazine.netOpen source ↗.

The vulnerabilities were reported to two automakers in early 2026, and both fixed them about two hours after receiving the report. Curry and colleagues published their findings on 7 November 2026, after the fix, and said the affected credentials had also been updated.