Security researcher Shubham Shah (Assetnote co-founder) published research on 7 November 2026, with Sam Curry, on an unnamed automaker's connected car systems. Shah writes that an internet-facing admin tool under the automaker's Australian telematics domain exposed a JavaScript bundle with hardcoded API keys, and a vendor JavaScript bundle embedded admin credentials for the ForgeRock OpenIDM identity system; though meant for staging, the researchers used them against production.

Shah says one endpoint returned password and PIN hashes, mobile push tokens, phone numbers and full names; they could overwrite any user's password and, in the Australian environment, skip multi-factor authentication through a Resource Owner Password Credentials grant, mint a consumer app token and issue remote commands.

His published chain is plate -> VIN -> subscriber GUID -> OpenIDM admin credentials -> path traversal to bypass the WAF -> MFA bypass -> app token -> remote command API, which he says let them send commands to any of the automaker's vehicles in Australia across both its brands; with Curry's separate write-up they could unlock and start engines for its vehicles in Australia, the United States and Canada.

Shah says they did this only on cars they owned or had permission to use. (source: Shubham Shah) According to iTnews (10 November), the carmaker sells two brands in Australia, the researchers were asked not to name it, and it fixed the flaw within hours of the report without a bug bounty. (source: iTnews)