Default ForgeRock credentials expose two automakers' car controls

Researchers discovered that two car brands' mobile apps used ForgeRock identity servers with default admin credentials, allowing complete account takeover. An attacker gaining access could unlock doors and start engines of connected vehicles for any customer. The vulnerability affects Ping Identity's ForgeRock platform and requires immediate credential changes and access reviews.