ForgeRock/PingIDM default admin:admin console: customer account takeover and remote car unlock
Severity: high · Patch status: partial · Since 2026-11-07
Shubham Shah and Sam Curry published on 2026-11-07 a chain against the ForgeRock (Ping Identity) login servers of two automakers, whose names the researchers withheld at the companies' request. In early 2026 they reached the OpenIDM Apache Felix web console on the identity server, a console the vendor's documentation says to remove or protect before production. The edge's WAF and the Java server parsed one encoded path differently, which let the request reach the console, and the console still accepted the documented default admin:admin credentials. From the console they created a scheduled script that ran code on the identity server, then used it to reset any customer's email and password, sign in through the normal app flow, and call the account's own commands to unlock and start a connected car. They ran the vehicle commands only on US test cars owned by consenting people. Both automakers fixed the reported issue about two hours after the report and rotated the affected credentials. A separate Australian chain, published by Shah the same day, used OpenIDM admin credentials embedded in a vendor JavaScript bundle, a path-traversal variant of the same WAF gap, and an MFA skip; the two write-ups together reach vehicles in Australia, the US and Canada. No date for the Australian fix is published. No CVE exists, because the researchers describe a deployment misconfiguration rather than a product bug. Neither write-up says whether anyone else found or used the path before it was closed.
What to do
- Check for an Apache Felix console at /system/console on ForgeRock/PingIDM deployments; remove it or change its default admin:admin password
- Do not rely on edge/WAF path rules to hide admin pages — eliminate path-parsing discrepancies between edge and backend
- Rotate and remove any credentials embedded in mobile app code or JavaScript bundles, including staging and test credentials
- Audit identity-server admin consoles for default or weak credentials and restrict management access properly
- Review account-takeover detection: email/password changes that don't force logout or re-verify are dangerous
- Make sure MFA cannot be skipped through resource-owner password-grant token requests, and do not expose OpenIDM endpoints on public hostnames
Sources
All live incidents on Threat Watch
