TL;DR
Get business pricing on garage and car supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A November 7, 2026, report by shubs describes security weaknesses found with researcher Sam Curry in a major automaker’s connected-car systems. The researchers say the issues could link vehicle registration details to customer account information and, if an attacker obtained a valid user token, permit remote commands such as unlocking a car. The supplied report excerpt ends before explaining how a token could be obtained, and does not identify the automaker or confirm the flaws’ remediation.
A security researcher writing as shubs reported November 7 that an investigation with Sam Curry found weaknesses in an unnamed automaker’s connected-car systems that could expose customer account details and potentially enable remote commands to vehicles. The report says access to a valid customer authentication token would allow commands including unlocking and locking; the supplied excerpt does not describe the final step needed to obtain such a token or establish whether any customer was affected.
The researchers began by examining the automaker’s mobile app and the internet-facing services it used. According to shubs, they found a publicly reachable administrative tool whose JavaScript bundle contained hardcoded API keys. The report says some administrative APIs could be accessed with those keys and used to look up customer accounts and vehicle-related records.
Shubs describes a chain that could start with a vehicle’s number plate. In Australia, the report says, state registration lookup services can make a vehicle identification number, or VIN, relatively accessible. The researchers then say they found an API that could connect a VIN to a subscriber identifier and use that identifier to retrieve account details, including an email address. These are findings reported by the researchers; the excerpt does not independently verify them or state how widely the affected services were exposed.
The administrative tool, according to the post, could provision vehicle features, add a secondary user to an account and generate remote access codes, but those functions alone did not give the researchers control of a car. They then examined the automaker’s identity system. The report says the mobile app received an authentication token after a user completed a multifactor authentication flow, and that the token was used for requests to connected-car services. The researchers say a valid token could authorize commands including remote unlocking, locking, horn activation and engine functions.
Customer Data and Vehicle Access
The reported weaknesses matter because they connect personal information with systems capable of sending commands to a vehicle. If the account lookup chain and token controls worked as described, an attacker could potentially use details tied to a car to identify a customer and then seek access to services that affect the vehicle remotely. The account and vehicle-control risks are related, but the excerpt does not establish that registration information alone was enough to unlock a car.
Remote unlock and engine-related functions can carry physical safety and security implications, while exposed account details can increase risks of targeted scams or unauthorized account access. The report describes a technical investigation, not evidence of criminal use. It does not say that vehicles were stolen, customers were harmed, or the researchers issued commands to cars belonging to other people.
For readers, the distinction between a vulnerability and a demonstrated real-world attack is important. The post presents a potential route through connected services and says the researchers were looking for a way to mint a user token. Because the provided text ends during that investigation, the full exploit path and its practical limits are unknown.
Products Worth Considering
Chemical Guys 17-Piece Car Detailing Kit for Interior, Exterior, and Wheels
Autel MaxiCOM MK808BT PRO Bidirectional OBD2 Diagnostic Scanner
Chemical Guys 10-Piece Car Wash Kit with Foam Gun
As an affiliate, we earn on qualifying purchases.
From App Traffic to Identity Systems
The investigation began after shubs bought a new four-wheel-drive SUV from the unnamed manufacturer in 2023 and gained access to its connected-car platform. The author says they had previously been skeptical about the security of such services and began looking into the platform with Curry in July 2026.
Rather than starting with a vehicle’s physical electronics, the researchers traced the mobile app’s internet-facing services by downloading and decompiling its Android package. The report says much of the app communicated with the automaker’s telematics domain. They then examined a subdomain hosting a page labeled “TEST HARNESS,” identified in the post as an administrative tool, before turning to the separate identity platform used to authenticate consumers.
The report identifies the identity software as ForgeRock OpenAM and OpenIDM. It says the automaker used OpenIDM to manage identities on the connected-car platform and that mobile-app authentication involved multifactor authentication. The excerpt provides no automaker name, exact affected vehicle models, or account totals, so the findings cannot be tied to a specific brand or fleet from this material alone.
““The journey started with a simple question: what infrastructure does the app talk to when I remotely unlock my car?””
— Shubs, the report’s author
Exploit Path and Repair Status
The supplied report ends mid-sentence while describing JavaScript files on the identity system, before detailing the suspected method for minting a token. It therefore does not establish whether the researchers completed that step, successfully controlled a vehicle, or demonstrated the full chain in a controlled test.
The automaker is not named in the supplied material, and there is no company statement, independent technical review, regulator notice or customer notification included. The report excerpt also does not say when the issues were disclosed to the company, whether they were fixed, whether the public-facing APIs remain accessible, or how many accounts or vehicles could have been affected.
Disclosure and Security Response
The next details needed to assess the risk are the full technical account of the identity-system findings, confirmation of whether a token could be obtained without the account holder’s authorization, and information about any safeguards or fixes put in place. A response from the automaker would also clarify the affected services, the period of exposure and whether customers need to take action.
The report excerpt does not provide a timeline for further disclosures or say whether the researchers plan to publish additional findings. Until that information is available, the described weaknesses should be treated as researchers’ reported findings, not confirmation of an active attack or of a specific manufacturer’s current exposure.
Key Questions
Did the researchers unlock a stranger’s car?
The supplied excerpt does not say that they unlocked a vehicle belonging to another person. It says a valid customer token could enable remote commands, but the text ends before explaining whether the researchers obtained such a token or tested commands on a car.
Which automaker was affected?
The report uses the term “the automaker” and redacts its service domains. The supplied material does not identify the brand, so the findings cannot be attributed to a named manufacturer on this evidence.
What customer information was reportedly exposed?
Shubs says the APIs could link a vehicle identification number to a subscriber identifier and retrieve account details, including an email address. The report excerpt does not state how many records were accessible or whether anyone outside the researchers accessed them.
Does the report say the security issues have been fixed?
No. The supplied excerpt contains no remediation status or company response. Whether the APIs were secured, the identity system changed, or customers were notified remains unclear.
Source: shubs.io
