TL;DR
A security researcher and Sam Curry reported finding weaknesses in a major automaker’s connected-car infrastructure, including exposed administrative APIs and a route they say could lead to control of customer vehicles. The source redacts the company’s identity and ends before describing the final identity-system finding, so the full exploit, affected models and markets, and remediation status are not confirmed here.
A security researcher and collaborator Sam Curry say they found weaknesses in a major automaker’s connected-car systems that could expose customer account information and, with a valid authentication token, allow remote vehicle commands such as unlocking and locking. The report, published November 7, 2026, does not name the automaker and the supplied account cuts off before explaining the final identity-system finding, leaving the exploit’s full scope and current status unclear.
Get business pricing on garage and car supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
The researcher says the investigation began by examining the automaker’s mobile app and identifying the internet-facing services it used. In a publicly accessible administrative tool, the researchers found APIs that they say had few restrictions and, in many cases, relied on API keys embedded in the application’s JavaScript. The report describes functions that could expose account information and allow operations involving customer accounts and production vehicles.
According to the report, the researchers linked a vehicle’s registration plate to its vehicle identification number (VIN), then used an API to connect that VIN to a subscriber identifier and account details, including an email address. The author notes that obtaining a VIN through registration lookup services is not itself presented as a security flaw; the concern was the ability to link it to subscriber and account information through the automaker’s APIs.
The report says the administrative tool alone did not provide remote control of vehicles. The researchers then examined the automaker’s identity platform, which issued authentication tokens used by the connected-car services. They say possession of a customer’s valid token would permit commands including remote unlocking, locking, horn activation and engine-related functions. The supplied source ends as it begins describing a JavaScript discovery tied to the identity system, without setting out the full method used to obtain a token.
Risks to Connected-Car Accounts
If the reported chain could be used against real customer accounts, the consequences would extend beyond exposure of personal information. Remote vehicle commands could affect a car’s physical security, while access to identity data could help an attacker target an owner or attempt further account compromise. The account does not establish that vehicles were actually accessed or that any customer was harmed.
The report also highlights how connected-car services depend on a network of mobile apps, administrative tools, APIs and identity systems. A weakness in one layer may have broader effects when services share account identifiers or rely on tokens that authorize vehicle commands. The researcher’s account describes a route across these layers, but the incomplete technical explanation prevents independent assessment of how practical or widespread the risk was.
Readers should not infer that every vehicle made by the unnamed company is currently vulnerable. The report’s headline refers to cars in “most of the world,” but the material provided here does not specify affected countries, models, production years, or whether the described access worked across the entire fleet.
Products Worth Considering
Chemical Guys 17-Piece Car Detailing Kit for Interior, Exterior, and Wheels
Chemical Guys 16-Piece Ceramic Car Wash and Protection Kit with Big Mouth Foam Cannon
Autel MaxiCOM MK900BT Bidirectional OBD2 Diagnostic Scanner
As an affiliate, we earn on qualifying purchases.
How the Researchers Traced Access
The author says they bought a new four-wheel-drive SUV from the automaker in 2023 and had become interested in the security of its connected-car platform. In July 2026, they worked with Sam Curry to examine the system, beginning with requests made by the mobile app when a user remotely unlocks a vehicle.
The report describes two stages. First, the researchers examined a publicly reachable administrative interface and found APIs that could retrieve or modify account-related information. They say this stage did not let them issue commands to a vehicle. They then spent two weeks studying the central identity system and the authentication flow used by the consumer app. The report identifies ForgeRock products, including OpenAM and OpenIDM, as part of the automaker’s identity infrastructure.
The source redacts the company’s name and its service domains. It is an account by the researchers, rather than a disclosed technical advisory or an independent verification. The provided text does not include a company response, a regulator’s assessment, or details of a public security notice.
““Once you have that auth token, it’s pretty much game over.””
— The report’s author
Scope and Fixes Remain Unknown
The supplied report is incomplete: it stops just as the author introduces a finding in JavaScript files related to the identity system. It therefore does not show how a customer token could be obtained, whether the researchers successfully used such a token against a vehicle, or what safeguards might have limited the commands.
The automaker is not named in the source material, and there is no information here about affected vehicle models, countries, customer numbers, the date the company was notified, or whether the weaknesses have been fixed. The report also does not provide a company statement or describe any confirmed real-world exploitation. Those gaps mean the account supports reporting that researchers described a potential attack chain, not that an active attack or universal vulnerability has been independently established.
Disclosure and Remediation Details
The next useful information would be the full technical report, including the missing identity-system findings, the researchers’ disclosure timeline, and evidence of which vehicle commands could be performed under test conditions. A response from the automaker could clarify whether it investigated the APIs, revoked exposed credentials, changed authentication controls, or notified affected customers.
Until those details are available, owners should rely on official communications from their automaker and keep connected-car apps and account credentials secure. The source does not establish that customers need to take a particular action, nor does it confirm that the reported weaknesses remain exploitable.
Key Questions
What did the researchers report finding?
They described exposed administrative APIs that could link vehicle identifiers to customer account information, followed by an investigation of the identity system used to authenticate connected-car app users. They say a valid customer token could authorize remote vehicle commands.
Could the researchers unlock any car from the automaker?
The headline makes that broad claim, and the report says a valid token could permit remote unlocking. But the supplied text does not identify the company or affected models and markets, and it ends before explaining how the researchers obtained a token. The full scope cannot be verified from this material.
Was the weakness used to access customer cars?
The source does not confirm real-world attacks or customer harm. It describes the researchers’ findings and the capabilities they say were available, but does not establish that an unauthorized person used them against customers.
Has the automaker fixed the reported issues?
The supplied report does not say whether the company was notified or whether any fixes were deployed. It also provides no company response or customer guidance.
Source: shubs.io
