Security researchers have reported that some automakers’ systems contain vulnerabilities that could allow car doors to be remotely unlocked or engines to be started. The manufacturers have not been publicly named, but Toyota and Lexus have been identified as possible automakers affected.

Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access
https://samcurry.net/forgerock


unlocking any car from X brand in most of the world
https://shubs.io/unlocking-any-car-from-x-brand-in-most-of-the-world/

In recent years, cars have been equipped with features that allow users to lock and unlock doors and start the engine from a smartphone. However, if the system connecting the vehicle and smartphone has a vulnerability, a third party may take control of it.


Security researchers Shubham Shah and Sam Curry investigated the “ForgeRock” authentication system used by automakers and discovered multiple vulnerabilities.

According to Shah, in Australia, it was possible to look up a vehicle identification number from a car’s license plate and identify the owner’s account. It was also possible to exploit vulnerabilities in the authentication system to change the password and remotely control the vehicle.


Meanwhile, Curry and his team also discovered vulnerabilities in the authentication system in the United States. They reported that, by running unauthorized programs on the server, it was possible to unlock car doors, start and stop the engine, and obtain location information.

According to the research team, remote-control commands could be sent to vehicles in Australia, the United States, and Canada. However, the functions that can actually be controlled appear to vary depending on the vehicle model and service subscription.


The research team has withheld the manufacturers’ names, but on Hacker News, where engineers gather, it has beensuggestedthat the automakers in question may be Toyota and Lexus, partly because the vehicle shown in the verification video resembles a Toyota “RAV4.” However, this has not been confirmed as of the time of writing.

The discovered vulnerabilities were reported to two automakers in early 2026, and both companies reportedly fixed them within approximately two hours of receiving the reports. Curry and his team published their findings on November 7, 2026, after the issues had been fixed, and stated that the affected authentication credentials had also been updated.