ForgeRock Default Password: admin:admin Let Researchers Into Two Automakers' Login Systems and Start a Car, and What to Check on Yours

Researchers say a default username and password, admin:admin, on a ForgeRock identity server let them take over customer accounts at two unnamed automakers and use the normal car app to unlock and start a connected car. If your company or one of its vendors runs ForgeRock or PingIDM for customer logins, the same forgotten admin page could put every account behind it at risk.

Shubham Shah and Sam Curry published their findings on November 7, 2026, in a joint technical write-up and a companion post by Shah. ForgeRock was combined into Ping Identity in August 2023, and its identity management product now appears in Ping's documentation as PingIDM.

What happened with the ForgeRock admin:admin password

An identity platform is the system that decides who you are when you sign in. In these deployments, ForgeRock Access Management ran the logins and ForgeRock Identity Management (also called OpenIDM) held the customer records. OpenIDM includes the Apache Felix web console, an administrator page at /system/console with its own separate login.

The researchers describe this chain against production systems:

1. Getting past the edge. The web application firewall blocked direct requests to admin pages. By changing how the web address was encoded, they sent a request the firewall treated as a harmless static file while the Java server behind it routed the request to the hidden console.
2. The default password. The console accepted admin:admin.
3. Running code. From the console they created a scheduled job that ran their own code on the identity server.
4. Taking over an account. They changed the email and password on a customer record, then signed in through the normal mobile login, including the emailed one-time code.
5. Reaching the car. The login produced the same tokens the app uses. The write-up lists location and telemetry, door lock and unlock, and remote engine start and stop.

Two details should worry anyone running customer accounts. Changing the email and password did not end the owner's existing app session, so nothing obvious would have happened on the owner's phone. The researchers' proof of concept could also register a push token they controlled, which stopped the corresponding notifications from reaching the owner.

What is confirmed, what is claimed and what is not known

Confirmed in vendor documentation. Ping's IDM 7.2 security guide tells customers to remove or protect the Felix console before going to production, and says its authentication is not integrated with authentication for IDM. The configuration shown there falls back to admin for both the username and the password unless other values are set.

Reported by the researchers, with no independent confirmation we could find:

• They could create a valid session for any customer account managed by the affected deployments.
• They unlocked and started one vehicle, then stopped and locked it, with the owner beside it. They say they tested only with US accounts and vehicles in the complete chain, and only on cars they owned or had permission to use.
• Both automakers fixed the issue about two hours after receiving the report and rotated the affected credentials.
• In a separate route described by Shah, a vendor JavaScript bundle contained OpenIDM admin credentials meant for a staging system, and those credentials worked in production. Shah says the multi-factor step could be skipped in the automaker's Australian environment, allowing commands to its vehicles there across both of its brands. Shah says the two write-ups together cover Australia, the United States and Canada.

Not known:

• Which automakers were involved. Neither post names them, and neither says whether Shah's automaker is one of the two in the joint write-up.
• Whether anyone else found this first. Neither post mentions earlier exploitation, which is not the same as saying there was none.
• How many accounts or vehicles were exposed. The joint write-up says only multiple regions.
• Whether the Australian route was fixed. Shah's post does not mention reporting or a fix, and the two-hour fix in the joint write-up does not mention Australia.
• When the work happened. The joint write-up says early 2026, with sample traffic dated February 17, 2026. Shah's post says "This July." Neither explains the difference.
• Which IDM versions were running. The only version given is Felix 7.0.1.
• What Ping Identity or the automakers say. We found no statement from any of them.

Why this matters for a company network or website

This is not only a car story. A company's identity server sits in front of customer portals, staff tools, payment accounts and anything else that trusts its logins. Whoever controls it does not need to break into each application, because they can simply sign in as anyone.

The chain also shows that hiding an admin page is not the same as securing it. The firewall was doing its job until two pieces of software read the same address differently. A default password behind that rule was the only remaining barrier. It is also a reminder that account recovery and profile changes are attack paths, which we covered in our passkey and account recovery guide.

Finally, nobody gets an update notice for a setup step that was skipped. This kind of gap survives patching, which is why someone has to own the servers your business depends on.

What to do this week: ForgeRock and PingIDM checklist

Only test systems you own or have written permission to test.

ForgeRock default password questions people are asking

Is this a ForgeRock vulnerability or a misconfiguration?

Mostly it looks like a deployment gap, in our reading. Ping's guide already says to remove or protect the console. The path handling differences between the firewall, Jetty and ForgeRock's CREST layer are a separate factor, and we found no statement from Ping about them.

Is there a CVE or patch for the ForgeRock admin:admin issue?

The joint write-up names no CVE, and our searches found no Ping advisory for this work. Treat it as a configuration check, not an update to install.

Does this affect Ping Identity customers?

It can affect anyone running ForgeRock IDM, OpenIDM or PingIDM with the Felix console left in place. We confirmed the guidance in the 7.2 documentation. Check the guide for your own version, because details can differ.

Which car brands were affected?

The researchers do not name them, so any list you see elsewhere is not supported by their posts.

Was anyone's car actually hacked?

The researchers describe authorized tests on vehicles they owned or had permission to use. Neither post reports criminal use, and neither says whether it occurred.

What should connected car owners do?

No brand has been named, so there is no specific action to take. Sensible habits apply: use a unique password on the car app, and check the account's email address and linked drivers.

The bigger lesson

The most expensive security failures are often the boring ones: a default password, a test credential that also works in production, a setup step nobody signed off. Your identity system deserves the most careful setup in your company, because everything else trusts its answer. Updated is not the same as secure, and a hardening checklist only helps if someone completes it and checks it again.

Want someone to review your identity servers and admin pages? See our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Hacking Two Automakers, Shah and Curry; Unlocking any car from X brand, Shah; PingIDM 7.2 security guide; Thoma Bravo announcement.