TL;DR
Get business pricing on garage and car supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A November 7, 2026, report by shubs and security researcher Sam Curry describes weaknesses in an unnamed automaker’s connected-car systems. The researchers say the issues could let an attacker link a vehicle’s registration number to account details and, through a separate identity-system flaw, obtain access capable of issuing remote commands. The supplied report ends before explaining that final flaw or stating whether the automaker fixed the issues.
Security researchers writing under the name shubs say they found weaknesses in an unnamed automaker’s connected-car systems that could expose customer account information and, if an attacker obtained a valid account token, allow remote vehicle commands such as unlocking a car. The report, published November 7, 2026, describes a chain involving public-facing administrative tools and an identity platform; the material provided does not identify the automaker or explain the final identity-system flaw in full.
The researcher says the investigation began by examining the automaker’s mobile app and the internet services it used. In a collaboration with Sam Curry, the researchers inspected the app’s software and mapped requests to the company’s connected-car and identity services. The brand, company domains, and some technical details are redacted in the source material.
According to the report, an exposed administrative tool included APIs that could be called using keys embedded in the tool’s JavaScript files. The researchers say those APIs could identify accounts by email and connect a vehicle identification number, or VIN, to a subscriber record and account details. The report describes a possible lookup chain from a registration number to a VIN, then to a subscriber identifier and customer information. It does not say that a registration number alone directly unlocked a car.
The report says vehicle commands required a consumer authentication token, normally issued after the app’s login and multi-factor authentication process. A token could then be used with the connected-car APIs to issue commands, including locking or unlocking. The researchers say they spent two weeks examining the company’s identity systems, but the supplied text stops as they begin describing how they might obtain a token. It therefore does not provide enough detail to independently assess that final step or confirm the full attack chain.
How Account Access Could Reach Cars
The reported weaknesses matter because connected-car services link online accounts to physical functions. If an attacker could move from exposed account data to a valid authentication token, the report says the token could provide access to commands such as remote unlocking. That could create risks for vehicle privacy and security beyond the loss of personal information.
The distinction between the stages is important. The report describes access to customer details through administrative APIs, then separately discusses the need to obtain an authenticated token before issuing vehicle commands. The source material does not establish that every stage was successfully used against a real customer or vehicle. It also does not report thefts, injuries, or other resulting harm.
For owners, the account underscores that vehicle security depends not only on the car’s onboard systems but also on the company’s web applications, identity controls, and API access. At the same time, the source does not name the manufacturer, so readers cannot use it to determine whether their own vehicle or account is affected.
Products Worth Considering
Chemical Guys 17-Piece Car Detailing Kit for Interior, Exterior, and Wheels
Milwaukee M18 FUEL Automotive Combo Kit, 1/2-Inch High-Torque and 3/8-Inch Impact Wrenches
Innova 5610 OBD2 Bidirectional Scan Tool
As an affiliate, we earn on qualifying purchases.
From App Inspection to Identity Systems
The author says they bought a new four-wheel-drive SUV from the automaker in 2023 and became interested in examining its connected-car platform. The investigation focused on internet-facing software rather than vehicle hardware: the app’s network requests, related web services, administrative functions, and authentication process.
The report says the admin tool appeared on a subdomain associated with the automaker’s telematics services and displayed a page titled “TEST HARNESS.” Its JavaScript bundle exposed details of the tool’s APIs. The researchers describe functions for looking up accounts, linking a VIN with a subscriber record, managing account access, and generating remote access codes. They say these functions alone did not give them control of a vehicle.
The researchers then examined the identity service, which the report identifies as using ForgeRock OpenAM and OpenIDM. According to their account, customers received a token after completing login and multi-factor authentication, and that token authorized requests to vehicle APIs. The supplied report provides this sequence but cuts off before detailing the finding that prompted its claim about broader vehicle access.
““The journey started with a simple question: what infrastructure does the app talk to when I remotely unlock my car?””
— shubs, the report’s author
Identity Flaw Details Remain Missing
The source material ends midway through the account of the identity-system investigation. It does not explain the exact vulnerability, show how a customer token could be minted or taken over, or state whether the researchers successfully issued commands to a vehicle they did not own. The report’s broad claim about access to cars therefore cannot be fully evaluated from the supplied excerpt.
The automaker is not named, and the excerpt contains no company response, disclosure timeline, or confirmation that the issues were fixed. It also does not specify how many accounts or vehicles could have been affected, whether exploitation was observed outside the research, or whether customers were notified. Those details remain unconfirmed.
Disclosure and Fix Status Needed
The next information needed is the remainder of the researchers’ technical account and any disclosure or remediation details. A fuller report could clarify how the identity-system issue worked, what testing was performed, and whether the researchers notified the automaker before publication. The automaker’s response would help establish whether the described APIs were changed and whether customer accounts or vehicles require protective action.
Until those details are available, the source does not support naming a brand, estimating the number of affected vehicles, or saying that an attacker can currently unlock cars through the described route. Owners who are concerned can follow official notices from their vehicle maker and keep account credentials protected, but the report does not identify a specific recall or customer-facing mitigation.
Key Questions
Which automaker is involved?
The report redacts the company and its web domains, so the automaker cannot be identified from the supplied material.
Does the report prove that a car was unlocked?
The excerpt says a valid account token could be used for commands such as remote unlocking, but it does not describe a successful test on another person’s vehicle. The final steps of the alleged attack are missing from the supplied text.
What information did the exposed tool reportedly reveal?
The researchers say they could connect a VIN to a subscriber record and retrieve account details, including an email address. They describe reaching a VIN from a registration number through lookup services, but do not say the registration number directly granted vehicle access.
Has the issue been fixed?
The source material does not state whether the automaker was notified or whether it repaired the reported weaknesses. No remediation status is confirmed in the excerpt.
Source: shubs.io
