Researchers Expose Critical Flaws in Two Automakers' Connected Vehicle Systems
Security researchers discovered hardcoded administrator credentials and multiple API vulnerabilities that allowed remote access to vehicle controls and customer data across two major automakers' fleets.
Two security researchers uncovered severe backend infrastructure weaknesses in the vehicle connectivity systems of two automakers during early 2026, gaining the ability to remotely unlock doors and start engines on any connected vehicles operated by these manufacturers across multiple geographic regions.
The core problem stemmed from hardcoded administrator credentials that were visible in the systems, combined with multiple poorly secured server APIs used by the automakers' mobile applications. While the most alarming capabilities involved remote door unlocking and engine ignition, the same vulnerabilities also granted access to sensitive vehicle telemetry including location data, mileage readings, fuel levels, driving range estimates, and door lock status. Customer personal information was similarly exposed through these same security gaps.
Both automakers moved quickly to patch the identified vulnerabilities once they were disclosed.