Two carmakers left an admin console of their customer login system on its factory password. The researchers who found it could sign in as any customer and unlock, start and locate their cars.
Sam Curry and Shubham Shah, who found similar holes at Subaru before, published the details on Saturday, November 7, on Curry’s blog. The work itself dates from early 2026. Both automakers fixed the problem about two hours after the report and changed the exposed credentials.
Which automakers? They asked not to be named.
Source: Privacy Affairs · 2026-11-07