TL;DR
Get business pricing on garage and car supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A November 7, 2026 report by shubs describes a security investigation with Sam Curry into a major automaker’s connected-car systems. The researchers say they found exposed administrative APIs and traced a possible path toward controlling customer vehicles, but the supplied report ends before explaining the final identity-system finding. It does not establish whether the flaw was exploited, fixed, or affected vehicles outside the tested region.
A security researcher writing as shubs reported on November 7, 2026, that an investigation with Sam Curry found weaknesses in a major automaker’s connected-car systems, including administrative APIs that could expose customer account information and a possible route to vehicle commands. The report’s supplied text stops as the researchers describe a finding in the automaker’s identity system, so it does not establish how the attack chain was completed or whether any car was actually unlocked.
The investigation began with the automaker’s mobile application, which the researchers decompiled to identify the internet services it contacted. According to shubs, much of the app relied on a telematics domain, where they found a subdomain hosting a page titled “TEST HARNESS.” Examining its JavaScript bundle revealed administrative functions and API requests, the report says.
Shubs writes that some of those APIs accepted requests using hardcoded API keys found in the publicly served JavaScript. The researchers said they could look up accounts using an email address and link a vehicle identification number to a subscriber identifier and account details, including an email address. The report describes a chain from a registration plate to a VIN, then to a subscriber record and personal information. It does not say that registration-plate lookup itself was a security vulnerability.
The researchers said the admin tool also offered functions such as provisioning vehicle features, adding a secondary user and generating remote access codes, but that these capabilities alone did not give them control of a car. They then examined the automaker’s identity platform. According to the report, the mobile app used a consumer authentication token for later requests to telematics services; possession of a valid customer token could permit remote actions, including locking or unlocking a vehicle. The excerpt ends before it explains the identity-system finding that the researchers believed might let them obtain such a token.
Risks to Connected-Car Accounts
The reported weaknesses matter because connected-car services can link personal account data to functions that affect a physical vehicle. If an attacker could turn exposed information into a valid customer authentication token, remote features such as unlocking or locking might be at risk. The report, however, does not document a successful unauthorized unlock, identify a victim, or provide evidence that the described chain was used against customers.
The account also illustrates why security reviews of internet-facing vehicle services extend beyond the car’s onboard hardware. Mobile apps, administrative interfaces, identity providers and APIs can all form part of the system that authorizes remote commands. A weakness at one layer could have implications for both privacy and vehicle access, depending on what an attacker can reach and what controls are in place.
Readers should treat the claim of broad access cautiously. The headline phrase “any car” is not substantiated in the supplied excerpt with details about tested models, countries, production environments, or successful vehicle commands. The report indicates a serious potential exposure, while leaving the actual scope and customer impact unresolved.
Products Worth Considering
Autel MaxiCheck MX808S Bidirectional OBD2 Diagnostic Scanner
Autel MaxiCOM MK808BT PRO Bidirectional OBD2 Diagnostic Scanner
Autel MaxiSYS MS906 MAX Automotive Diagnostic Scanner, 10.1-Inch
As an affiliate, we earn on qualifying purchases.
From App Requests to Identity
Shubs says the investigation began after the researcher bought a new four-wheel-drive SUV from the automaker in 2023 and examined the connected-car service. In July, the researcher worked with Curry on the security review. The automaker is not named in the supplied report; its domains and other identifiers are redacted, so the brand cannot be independently identified from this material.
The researchers first mapped the mobile app’s web-facing services, then inspected a publicly reachable administrative tool and its bundled code. They traced how the tool handled account and vehicle records, but report that it did not directly provide remote control. The investigation then shifted to the identity service, which the report identifies as using ForgeRock software, and to how the consumer app received authentication tokens.
This sequence is relevant because the reported route depended on linking several systems, not simply sending an unlock command to a public endpoint. The excerpt describes account lookup and authentication as separate stages, and does not provide the final technical evidence connecting them.
“what infrastructure does the app talk to when I remotely unlock my car?”
— Shubs, describing the investigation’s starting point
Scope and Fix Status Remain Unknown
The supplied report excerpt ends mid-sentence as the researchers describe finding a clue in JavaScript files that connected the investigation to the identity system. It does not include the full exploit details, the researchers’ final demonstration, or a technical account of whether they minted a customer token. It therefore does not confirm that they unlocked a vehicle or controlled any customer’s car.
The automaker’s identity, affected vehicle models, countries and number of potentially exposed accounts are not given in the supplied material. It is also unclear whether the researchers reported the issue privately, when the company was notified, whether the relevant APIs have been changed, or whether the company found evidence of exploitation. The phrase “in most of the world” cannot be assessed from the excerpt, which does not describe geographic testing or regional differences.
Disclosure Details to Watch
The next key information is the remainder of the researchers’ report, including the identity-system finding, the steps required to reach vehicle commands, and the scope of any testing. A full disclosure should clarify which services and markets were affected, whether the researchers demonstrated an unauthorized unlock, and what evidence supports the report’s broad geographic framing.
The automaker’s response and any remediation timeline are also not included here. Until those details are available, customers cannot tell from this material whether they need to change passwords, review account access, or take another specific step. The report excerpt does not advise a particular customer action, and it does not establish that connected-car owners face an ongoing, confirmed threat.
Key Questions
Did the researchers unlock a customer’s car?
The supplied excerpt does not confirm a successful unauthorized unlock. It says the researchers identified a path they were investigating toward remote commands, then ends before describing the final finding or any demonstration.
Which automaker is involved?
The automaker is not named in the supplied report. Its service domains and other identifying details are redacted, so the brand cannot be reliably determined from this source material.
What information did the researchers say they could access?
Shubs says some administrative APIs could link vehicle and subscriber records and expose account information, including an email address. The report does not state how many accounts were affected or whether anyone outside the researchers accessed the data.
Has the automaker fixed the issue?
The supplied material does not say whether the automaker was notified or whether any changes were made. Remediation status is unknown from this excerpt.
Source: shubs.io
