Hackers remotely unlock and start cars from two major automakers using hardcoded credentials

In early 2026, security experts discovered a serious vulnerability in the connected car network for two large automakers that permitted remote car door opening and engine start-ups. This security breach puts drivers and vehicle occupants at physical risk by permitting unauthorized entry into internet-connected vehicles. The event underscores how backend authentication weaknesses can have direct implications for physical vehicle control capabilities for average drivers.

Security breach allows remote engine start and door unlock via backend flaw

The flaw was traced to the ForgeRock authentication systems employed by the automakers for controlling user access to the connected car solutions. Researchers showed how they were able to exploit the vulnerability by evading a Multi-Factor Authentication (MFA) setup and using backend hardcoded credentials. The security team has withheld specific automakers names from public information due to the researcher's decision to keep the affected companies under wraps.

The attack vector was centered around misconfigured ForgeRock infrastructure that enabled attackers to circumvent authentication protocols meant to confirm user identities. Using the hardcoded credentials, hackers were able to access sensitive information such as vehicle location, mileage and fuel levels. Additionally, customer personal data related to the connected car accounts was exposed.

Through visual cues in the hacking demonstration video, the second automaker appears to be Toyota with confirmation of a RAV4 SUV model. The demonstration revealed remote control capabilities applied to the particular vehicle model – further strengthening the probability of the company being affected. Connected vehicles across the US, Australia and Canada are impacted by the vulnerability affecting many internet-enabled cars.

The revelation serves to confirm how authentication weaknesses in automotive backend software can present significant physical security threats. Automakers should audit their ForgeRock deployments to make sure MFA is implemented correctly and credentials are not hardcoded. Connected car services can introduce inherent risks if the backend security is not maintained to a high standard – drivers should be mindful of this.