ForgeRock Default admin:admin Console Exposed Customer Databases for Two Automakers' Vehicle Commands

Shubham Shah and Sam Curry mapped login flows in two unnamed automakers' apps to shared ForgeRock deployments. The OpenIDM component retained its built-in console at the default admin:admin pair. Edge WAF rules treated double-encoded slashes as static files while the Java backend routed them to the console endpoint. Once inside, scheduler tasks ran arbitrary Groovy scripts that yielded a shell on the customer record store. Account tokens extracted from that store authenticated directly to vehicle telematics endpoints. The researchers limited live tests to owned or consented US vehicles and reported both systems remediated within two hours. No CVE exists because the issue was configuration, not code. ForgeRock hardening guidance has warned against exposing the console since at least 2020, yet procurement and deployment records show repeated production instances left at factory settings across automotive IAM rollouts. This matches patterns seen in earlier misconfigurations of Ping Identity and ForgeRock stacks at other OEMs where default management interfaces survived containerization. The absence of independent telemetry on prior exploitation leaves open whether the same path was used before disclosure. Australian instances revealed a second vector: hardcoded admin tokens left in app binaries. Both failures trace to the same root: identity teams shipping test or staging artifacts into customer-facing production without the documented removal steps. Within six months, expect at least one additional OEM to disclose similar ForgeRock exposure once routine external attack-surface scans expand to identity management endpoints.