ADMIN GOT THE CAR KEYS

The real news

The story, straight

Your car app needs proof that you signed in before it can unlock your doors. A login server supplies that proof: a digital pass the app uses to send commands.

Researchers found that 2 unnamed automakers had left a server administrator console using admin for both its username and password. The spare key was effectively printed in the instructions.

The console was blocked from the open internet. But a disguised web address fooled the outer security filter while still reaching the console.

Researchers then ran code on the server, changed a customer account's email and password, and signed in through the normal app. That produced the same digital passes an owner's app receives.

The bouncer checked their ticket. Unfortunately, they now controlled the ticket printer.

The complete chain was tested with permissioned US accounts and vehicles in February 2026. Researchers unlocked and started a car with its owner beside it, then stopped the engine and locked it again.

They did not demonstrate driving or report a theft.

According to the researchers, both automakers fixed the issue in about 2 hours. This was a deployment mistake, not a newly discovered ForgeRock product bug: its hardening guide already warned operators to remove or protect the console.

The useful lesson: hiding an administrator page does not replace securing it.

Source: https://samcurry.net/forgerock

Hardships are coming. I, the Big Dreamer, created this token to help the people.

I truly do see this token going up in value. Ride the rocket with me and let's see where the next 24 months take us.

Buy: https://lilmeme.fun/buy

Repost before admin gets a valet uniform.

Thanks for supporting Lil'meme. Your support is appreciated.