TL;DR
Get business pricing on garage and car supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A November 7 report by a security researcher describes weaknesses found while examining a major automaker’s connected-car services with researcher Sam Curry. The report says exposed administrative APIs could reveal account information, and that a valid customer authentication token could control connected-car functions. The supplied report excerpt does not identify the automaker or include the final technical findings, company response, or evidence that vehicles were accessed without permission.
A security researcher says an investigation of an unnamed automaker’s connected-car platform uncovered weaknesses that could expose customer account information and, if an attacker obtained a valid authentication token, enable remote commands such as unlocking or locking vehicles. The report, dated November 7, 2026, says the work was conducted with researcher Sam Curry; the supplied excerpt does not identify the carmaker or establish that anyone used the weaknesses against customers.
The investigation began with the researcher examining the automaker’s mobile application to identify the internet services it contacted when a customer used remote functions. The report says the app relied heavily on services under a connected-car domain, then describes finding a publicly reachable page titled “TEST HARNESS” on an administrative-tool subdomain. The researcher says analysis of the tool’s JavaScript revealed APIs for interacting with customer accounts and vehicles.
According to the report, some administrative APIs relied on API keys embedded in the JavaScript bundle rather than requiring user authentication. The researcher says the APIs could be used to look up accounts and link vehicle information to customer records. The described sequence used a vehicle’s registration plate to obtain its VIN through Australian state registration lookup services, then queried the automaker’s systems to find a subscriber identifier and account details, including an email address. The report notes that obtaining a VIN through a registration lookup is not itself presented as a security flaw.
The researchers say the administrative tool did not, on its own, provide remote vehicle control. They then examined the automaker’s identity system and mobile-app login process. The report says the app obtained a customer authentication token after a multifactor authentication flow and used it for later requests to connected-car services. With such a token, the researchers said, remote functions could include locking or unlocking the car, sounding the horn and controlling the engine. The excerpt ends as it begins describing a further discovery in JavaScript files; it does not provide the complete technical account.
How Account Access Could Reach Vehicles
The report describes a potential chain in which weaknesses in online services could connect vehicle identifiers, customer account details and remote commands. If the account protections or token-issuing process could be bypassed, the consequences could reach beyond a privacy exposure: connected-car functions may affect whether a vehicle is locked and, depending on the vehicle and feature, other operations.
However, the distinction between a possible attack path and a confirmed customer impact is important. The supplied material reports researchers’ findings, but does not say that they unlocked vehicles belonging to unsuspecting owners, accessed customer accounts without authorization, or observed criminal exploitation. It also does not state how many vehicles or accounts might have been affected. Readers should treat the reported capabilities as security findings attributed to the researchers, not as evidence of widespread compromise.
Products Worth Considering
Chemical Guys 17-Piece Car Detailing Kit for Interior, Wheels, and Exterior
Autel MaxiSYS MS906 MAX Automotive Diagnostic Scanner, 10.1-Inch
Autel MaxiScope MP608 4-Channel Automotive Oscilloscope
As an affiliate, we earn on qualifying purchases.
From App Requests to Identity Tokens
The report describes two parts of the connected-car service: an administrative tool used to manage accounts and vehicles, and an identity system used when customers sign in to the mobile app. The researcher says the app communicates with the automaker’s telematics services and that a successful login, including multifactor authentication, produces a token used for subsequent requests.
The researchers say they spent two weeks examining how the identity system and command process worked after the initial API review. The report identifies ForgeRock OpenAM and OpenIDM as software used in the identity setup, and says an OpenIDM instance was publicly discoverable on a related domain. The automaker’s name and the real service domains are redacted in the supplied account, which limits independent identification and verification here.
Remote features in connected-car apps are designed to let authorized owners perform actions without being beside the vehicle. The report’s concern is not that remote unlocking exists, but that weaknesses in the services governing account identity and authorization could potentially let someone act as an authorized user.
“What infrastructure does the app talk to when I remotely unlock my car?”
— The researcher, describing the investigation’s starting point
Company Response and Customer Impact
The supplied report excerpt does not name the automaker, provide a response from the company, or say whether the reported weaknesses were disclosed privately and fixed. It does not include the remainder of the technical findings, a disclosure timeline, or details about any remediation. The account also gives no confirmed total for affected vehicles or customers.
It remains unclear whether the researchers demonstrated remote commands against a vehicle they owned or controlled, whether they were able to bypass multifactor authentication or obtain another customer’s token, and whether any unauthorized person exploited the systems. The report describes an authentication token as powerful, but the excerpt does not explain the specific vulnerability that might allow an attacker to mint or steal one. Those unanswered points are central to judging the practical risk.
Disclosure and Remediation Details
The next developments to look for are the complete technical report, a response from the automaker, and information about whether the APIs or identity services were changed. A company statement or disclosure record could clarify when the issues were reported, what protections were added, and whether customers need to take any action. Until those details are available, the supplied material supports a description of researchers’ reported findings, but not a conclusion that customer vehicles were remotely accessed.
Owners concerned about connected-car security can use official account channels to review access and available security settings, keep app software current, and contact the automaker for guidance. The report does not provide a specific warning or recall notice, so it should not be treated as one.
Key Questions
What did the researchers report finding?
They said an administrative tool exposed APIs that could reveal customer account information and that a valid customer authentication token could be used for remote vehicle commands. These are findings attributed to the researchers in the supplied report.
Does the report say that customers’ cars were actually unlocked?
No. The supplied excerpt describes a potential capability but does not say the researchers or anyone else remotely accessed an unsuspecting customer’s vehicle.
Which automaker is involved?
The source material redacts the automaker’s name and service domains. The company cannot be identified from the supplied excerpt.
Could a vehicle’s registration plate alone unlock it?
The report does not say that a plate alone was enough. It describes a sequence involving vehicle and account lookups, followed by the need for a valid authentication token to issue remote commands.
Has the company fixed the reported issues?
The supplied material does not include a company response or remediation details, so it is not clear whether the reported weaknesses have been fixed.
Source: shubs.io
