research (Sam Curry and Shubham Shah, published Nov 7, 2026); both unnamed automakers fixed the issue about two hours after the report and rotated credentials; no CVE
Researchers chained a WAF path-confusion bypass and ForgeRock's admin:admin Felix console default into RCE on two automakers' login servers, then unlocked and started cars
The core mistake: the edge and Jetty read the same URL differently. Encoded slashes, dot segments and semicolon path parameters made a blocked admin path look like a static asset.
The default: ForgeRock's hardening guide says to remove or protect the Felix console, which authenticates separately from IDM. Here it stayed up with admin:admin.
Impact: production identity access across both automakers' directories in multiple regions. Changing the email and password didn't log the real owner out, and the client-controlled push token let the researchers stop notifications from reaching the owner's phone.
If you run ForgeRock IDM/OpenIDM: remove or lock down /system/console, change every default credential, and test your WAF with encoded-separator and ; path variants of blocked admin routes.