In a detailed technical vulnerability disclosure published on November 7, 2026, Assetnote co-founder Shubham Shah (Shubs) and cybersecurity researcher Sam Curry unveiled an end-to-end attack chain capable of remotely unlocking, tracking, and controlling connected vehicles produced by a major global automaker.
The vulnerability chain began with public vehicle reconnaissance. By querying Australian state registration lookup portals with a target vehicle's license plate, the researchers retrieved its Vehicle Identification Number (VIN). From there, decompilation of the automaker's Android mobile application revealed an externally exposed testing harness at `admintool.redacted-telematics.com.au` that shipped its full single-page JavaScript bundle to unauthorized visitors.
Hardcoded API keys embedded within the client JavaScript enabled unauthenticated queries against internal endpoints, allowing the researchers to convert VINs into unique subscriber GUIDs and extract customer email addresses via a `/v1/account` endpoint. While this exposed extensive Personally Identifiable Information (PII), it did not immediately grant physical vehicle actuation.
The breakthrough occurred when auditing the automaker's ForgeRock OpenIDM identity platform. The researchers located staging administrative credentials bundled inside client assets that functioned across production environments. Although an Nginx Web Application Firewall (WAF) blocked standard administrative URI paths, automated AST path analysis using GPT 5.6 identified an unmonitored endpoint prefix at `/static%2f..%2fopenidm/managed/user/` that bypassed WAF inspection without confusing OpenIDM's servlet router.
Leveraging this path traversal, the researchers issued HTTP PATCH requests to overwrite account passwords arbitrarily. To bypass multi-factor authentication, they exploited a misconfigured OAuth 2.0 Resource Owner Password Credentials (ROPC) grant on the identity server to mint valid mobile app authorization tokens, concluding the chain by submitting authenticated `POST /v1/remote/route/command` payloads to lock, unlock, and honk vehicles remotely.