---
title: Researchers chained a WAF path-confusion bypass and ForgeRock's admin:admin Felix console default into RCE on two automakers' login servers, then unlocked and started cars | ctxsec
url: https://ctxsec.com/items/curry-shah-forgerock-openidm-felix-console-rce-two-automakers-remote-unlock
description: "Sam Curry and Shubham Shah say the production ForgeRock identity servers behind two unnamed automakers' mobile apps exposed OpenIDM's Apache Felix Web Console through a path the edge treated as static (/static%2f..;/system%2fconsole;/...). The console still accepted its documented admin:admin default, and its configuration manager let them schedule a Groovy script that installed a command servlet. From there they read the local OpenIDM admin credentials, rewrote any customer's email and password over localhost, completed the normal app login, and sent door-unlock and engine-start commands to test vehicles with the owner present. Both automakers fixed it in about two hours and rotated credentials."
status: "research (Sam Curry and Shubham Shah, published Nov 7, 2026); both unnamed automakers fixed the issue about two hours after the report and rotated credentials; no CVE"
published: 2026-11-09
---

> Sam Curry and Shubham Shah say the production ForgeRock identity servers behind two unnamed automakers' mobile apps exposed OpenIDM's Apache Felix Web Console through a path the edge treated as static (/static%2f..;/system%2fconsole;/...). The console still accepted its documented admin:admin default, and its configuration manager let them schedule a Groovy script that installed a command servlet. From there they read the local OpenIDM admin credentials, rewrote any customer's email and password over localhost, completed the normal app login, and sent door-unlock and engine-start commands to test vehicles with the owner present. Both automakers fixed it in about two hours and rotated credentials.

[← Cybersecurity News](/news) · [markdown](/items/curry-shah-forgerock-openidm-felix-console-rce-two-automakers-remote-unlock.md)

research (Sam Curry and Shubham Shah, published Nov 7, 2026); both unnamed automakers fixed the issue about two hours after the report and rotated credentials; no CVE

2026-11-09

### Researchers chained a WAF path-confusion bypass and ForgeRock's admin:admin Felix console default into RCE on two automakers' login servers, then unlocked and started cars

- **The core mistake:** the edge and Jetty read the same URL differently. Encoded slashes, dot segments and semicolon path parameters made a blocked admin path look like a static asset.
- **The default:** ForgeRock's hardening guide says to remove or protect the Felix console, which authenticates separately from IDM. Here it stayed up with `admin:admin`.
- **Impact:** production identity access across both automakers' directories in multiple regions. Changing the email and password didn't log the real owner out, and the client-controlled push token let the researchers stop notifications from reaching the owner's phone.
- **If you run ForgeRock IDM/OpenIDM:** remove or lock down `/system/console`, change every default credential, and test your WAF with encoded-separator and `;` path variants of blocked admin routes.

Sources: [Sam Curry and Shubham Shah: Hacking Two Automakers, ForgeRock Path Confusion, RCE, and Remote Vehicle Access (Nov 7)](https://samcurry.net/forgerock)