Default Credentials on ForgeRock Servers Allow Vehicle Access

# Default Credentials on ForgeRock Servers Allow Vehicle Access

https://gcdradar.vercel.app/incidents/default-credentials-on-forgerock-servers-allow-vehicle-acces · AIR-2026-1832 · live

- Lane: Research
- Severity: 1 (Research / proof of concept): Demonstrated by researchers with no known real-world exploitation reported yet.
- Fix status: Fix status unknown
- First reported: 2026-11-09
- AI role: No AI role
- Products: ForgeRock

## Summary

Security researchers discovered that default admin credentials on ForgeRock identity servers used by two car brands allowed complete account takeovers. This flaw enabled them to access customer accounts, unlock vehicle doors, and start engines.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-09: Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars (https://thehackernews.com/2026/11/default-adminadmin-server-password.html)

## Sources

- 2026-11-09 The Hacker News: Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars https://thehackernews.com/2026/11/default-adminadmin-server-password.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.