Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns

Security researchers Shubham Shah and Sam Curry found ways to exploit Android apps used by two unnamed carmakers, gaining remote access to connected vehicles in Australia and the US. The flaws let them issue commands including unlocking cars, starting engines, flashing headlights and sounding horns, showing how weaknesses in identity systems can affect physical vehicle security.

Both attacks involved flaws in the ForgeRock identity platform and techniques to bypass web application firewalls. In Australia, public registration lookups, exposed owner details and default administrative credentials helped the researchers take over accounts; in the US, they used default credentials in an administrative console to reach account data. The researchers said they reported the issues in early 2026 and the carmakers patched them within two hours. Toyota and Lexus were speculated to be involved, but neither was confirmed.