Default Server Credentials Enable Vehicle Account Takeover and Remote Start

Security researchers discovered that mobile apps from two major automakers allowed complete account takeover due to default credentials left active on their ForgeRock identity servers. This flaw granted unauthorized access to customer accounts, enabling remote door unlocking and engine starting on connected vehicles.