--- title: Unlocking any car from X brand in most of the world description: Security researchers Shubham Shah and Sam Curry found a chain of flaws letting them unlock and send commands to vehicles from a major automaker, starting from... canonical: https://daily.dev/posts/unlocking-any-car-from-x-brand-in-most-of-the-world-mhczvgj4u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Unlocking any car from X brand in most of the world | daily.dev og:description: Security researchers Shubham Shah and Sam Curry found a chain of flaws letting them unlock and send commands to vehicles from a major automaker, starting from... og:url: https://daily.dev/posts/unlocking-any-car-from-x-brand-in-most-of-the-world-mhczvgj4u og:image: https://api.daily.dev/og/posts/MhcZvgJ4u.png og:image:alt: Unlocking any car from X brand in most of the world og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unlocking any car from X brand in most of the world **[Hacker News](https://daily.dev/sources/hn)** · 12 min read · 0 upvotes · 0 comments ## Summary Security researchers Shubham Shah and Sam Curry found a chain of flaws letting them unlock and send commands to vehicles from a major automaker, starting from a number plate. They found hardcoded admin credentials for ForgeRock OpenIDM embedded in a JavaScript bundle. A path traversal trick bypassed the WAF protecting OpenIDM endpoints. From there they reset a user's password, bypassed MFA via an OAuth ROPC flow, minted a valid app access token, and issued remote unlock commands, with the combined writeups covering Australia, the US, and Canada. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did researchers manage to unlock any car from an automaker using just a license plate number? They chained a plate-to-VIN lookup, a VIN-to-subscriber-GUID API, hardcoded ForgeRock OpenIDM admin credentials found in a JavaScript bundle, a path traversal WAF bypass, an OAuth ROPC-based MFA bypass, and a minted consumer app token to reach the remote command API and send a door-unlock command. _Teams hardening connected car or IoT backends can track real-world exploit chains like this on daily.dev._ ### What is an OAuth Resource Owner Password Credentials (ROPC) grant used for in this kind of attack? It was used to request an authentication token directly from the identity server with a username and password, which was then exchanged for a session token and finally an app access token, entirely skipping the multi-factor authentication step that the normal login flow would require. _Developers evaluating OAuth flow security weigh ROPC risks like this one against their own auth design on daily.dev._ ### How did a WAF protecting ForgeRock OpenIDM get bypassed with path traversal? The WAF blocked direct requests to /openidm/ but whitelisted paths like /XUI/ and /UI/ without blocking traversal characters. While /XUI%2f..%2fopenidm/ still hit routing restrictions, the prefix /static%2f..%2fopenidm/ was not covered by the WAF at all and reached OpenIDM's internal servlets without the restriction, a path found after GPT 5.6 spent about six hours testing combinations. _Engineers auditing WAF rule coverage can compare path traversal bypass patterns like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 58 comments across hackernews (as of 2026-11-09). **TL;DR:** Discussion centers on guessing the redacted automaker (landing mostly on Toyota/Lexus) and debating whether this is a damning security failure or an understandable one, with a broader thread about whether connected cars are worth the risk at all. **Sentiment:** 10% positive · 35% mixed · 55% skeptical **The case for** - Some note the automaker responded fast, patching and rotating credentials within about two hours of disclosure. - A few credit the company for having real auth infrastructure in place rather than rolling its own, unlike many peers. - Some argue practical car theft risk from this kind of multi-step hack is low compared to simple smash-and-grab theft. **The pushback** - Hardcoding credentials in a front-end-exposed JS bundle is called an obvious, easily-preventable mistake that static analysis should have caught. - Several frame this as inevitable fallout from pushing business logic and APIs client-side instead of keeping it server-side. - Redacting the automaker's name is seen by some as self-protection for the researchers rather than genuine responsible disclosure. - Broader distrust of connected cars as vehicles for surveillance and data monetization rather than genuine user benefit. **By community** - hackernews (mixed): A large share of the thread is pure speculation on which automaker is redacted, alongside genuine disagreement over whether this reflects normal security difficulty or real negligence, plus a tangent on whether connected cars should exist at all. **Hottest debate:** Whether this incident shows a careless, easily-avoidable failure versus just how hard security realistically is, especially against the backdrop of whether always-connected cars are worth the risk. **Open questions** - Which automaker(s) were actually involved, since the name was redacted. - Whether older or non-connected vehicle models/years are also affected or are safe from this class of vulnerability. **Highlights** > Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular: - Never hard-code credentials (especially in front-end exposed code) - Never share credentials between environments (especially between prod and non-prod) And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible. > — [jaza on hackernews](https://news.ycombinator.com/item?id=50421217) > GM was doing this 25 years ago. It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what. They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure. Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent. > — [lakeviewterrace on hackernews](https://news.ycombinator.com/item?id=50420721) > Not if you take them (there are two security workers behind this) at their word: In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle. Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock > — [defrost on hackernews · 1 comments](https://news.ycombinator.com/item?id=50419600) > It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult. IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back. I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it. > — [anal\_reactor on hackernews · 3 comments](https://news.ycombinator.com/item?id=50420150) > These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked. You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc. Evil. > — [avodonosov on hackernews](https://news.ycombinator.com/item?id=50421154) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50419215) · 156 points · 58 comments ## Similar posts on daily.dev - [5 Lines of Code That Let Me Bypass Any MongoDB Login](https://daily.dev/posts/5-lines-of-code-that-let-me-bypass-any-mongodb-login-rmmtrbli9) · Medium · 0 upvotes · 0 comments - [Anyone on the Internet Can Ring Your Doorbell](https://daily.dev/posts/anyone-on-the-internet-can-ring-your-doorbell-phnpjhrsg) · Hacker News · 1 upvotes · 0 comments - [Automotive systems get pwned at Pwn2Own Automotive 2026](https://daily.dev/posts/automotive-systems-get-pwned-at-pwn2own-automotive-2026-ufj0xcrvq) · The Register · 0 upvotes · 0 comments - [A vehicle's head unit hacked via its modem](https://daily.dev/posts/a-vehicle-s-head-unit-hacked-via-its-modem-hlvyfve1z) · Securelist · 1 upvotes · 0 comments - [Hackers target WordPress sites in miniOrange auth bypass attacks](https://daily.dev/posts/hackers-target-wordpress-sites-in-miniorange-auth-bypass-attacks-ayedwsayu) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/unlocking-any-car-from-x-brand-in-most-of-the-world-mhczvgj4u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Unlocking any car from X brand in most of the world","url":"https://daily.dev/posts/unlocking-any-car-from-x-brand-in-most-of-the-world-mhczvgj4u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/unlocking-any-car-from-x-brand-in-most-of-the-world-mhczvgj4u"},"datePublished":"2026-11-09T02:45:09.421Z","dateModified":"2026-11-09T05:03:35.627Z","description":"Security researchers Shubham Shah and Sam Curry found a chain of flaws letting them unlock and send commands to vehicles from a major automaker, starting from...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/unlocking-any-car-from-x-brand-in-most-of-the-world-mhczvgj4u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,vulnerability","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Unlocking any car from X brand in most of the world"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/unlocking-any-car-from-x-brand-in-most-of-the-world-mhczvgj4u#faq","mainEntity":[{"@type":"Question","name":"How did researchers manage to unlock any car from an automaker using just a license plate number?","acceptedAnswer":{"@type":"Answer","text":"They chained a plate-to-VIN lookup, a VIN-to-subscriber-GUID API, hardcoded ForgeRock OpenIDM admin credentials found in a JavaScript bundle, a path traversal WAF bypass, an OAuth ROPC-based MFA bypass, and a minted consumer app token to reach the remote command API and send a door-unlock command. Teams hardening connected car or IoT backends can track real-world exploit chains like this on daily.dev."}},{"@type":"Question","name":"What is an OAuth Resource Owner Password Credentials (ROPC) grant used for in this kind of attack?","acceptedAnswer":{"@type":"Answer","text":"It was used to request an authentication token directly from the identity server with a username and password, which was then exchanged for a session token and finally an app access token, entirely skipping the multi-factor authentication step that the normal login flow would require. Developers evaluating OAuth flow security weigh ROPC risks like this one against their own auth design on daily.dev."}},{"@type":"Question","name":"How did a WAF protecting ForgeRock OpenIDM get bypassed with path traversal?","acceptedAnswer":{"@type":"Answer","text":"The WAF blocked direct requests to /openidm/ but whitelisted paths like /XUI/ and /UI/ without blocking traversal characters. While /XUI%2f..%2fopenidm/ still hit routing restrictions, the prefix /static%2f..%2fopenidm/ was not covered by the WAF at all and reached OpenIDM's internal servlets without the restriction, a path found after GPT 5.6 spent about six hours testing combinations. Engineers auditing WAF rule coverage can compare path traversal bypass patterns like this on daily.dev."}}]} ```