Connected car hack: admin keys sat in a JavaScript bundle

The car wasn't the weak point. The web app was. In a write-up published November 7, Assetnote co-founder Shubham Shah explains how he and researcher Sam Curry could unlock any of one automaker's cars in Australia with only the number plate. This connected car hack had no radio tricks and no hardware. It used an admin tool on the public internet and admin credentials left in a JavaScript bundle. An AI model found the last piece. Most small-business web apps have the same weak points.

What actually happened

The researchers only tested cars they owned or had permission to use. The post doesn't name the automaker.

• An admin tool on a public subdomain. A page titled "TEST HARNESS" let staff work with customer accounts and real vehicles. Many of its APIs needed only API keys that were hardcoded in its JavaScript.
• Plate to owner. A public registration lookup gave them the VIN. The admin APIs took them from the VIN to the subscriber ID, then to the account email.
• Staging credentials worked in production. A vendor JavaScript bundle had admin credentials for the automaker's ForgeRock OpenIDM identity system. The credentials were meant for staging, but they also worked in production.
• The WAF was a bandage. WAF rules blocked the sensitive OpenIDM paths. The researchers tried path-traversal bypasses by hand for days. Shah says GPT 5.6 then spent about six hours on the OpenIDM source and found a path prefix the WAF didn't cover.
• MFA could be skipped. The identity setup accepted an OAuth password grant (ROPC) that didn't ask for MFA. They could set a new password for any user, get an app token and send a door-unlock command.

Shah says the combined work with Curry allowed remote commands, including engine start, for the automaker's cars in Australia, the US and Canada. His post doesn't give a disclosure or fix timeline.

Why it matters for your business

Take away the car and you have a typical small-business stack. An internal tool sits on admin.yourdomain.com, a key sits in the front-end bundle, the staging password is the same as production, and a firewall rule covers something nobody fixed. An AI model needed about six hours to find the gap in that firewall rule. Attackers have the same tools.

1. Search your build output, not only your repo. Check .next/static, dist and build for key, secret, password and token. In Next.js, anything prefixed NEXT_PUBLIC_ goes to every visitor's browser.
2. List your subdomains. Certificate transparency logs (crt.sh) show what an attacker sees. Put admin and staging tools behind SSO or a VPN.
3. Use different credentials for each environment. Staging credentials must not work in production.
4. Turn off password grants. Enforce MFA on the server, not in the app's screens.

Sources: Shubham Shah, shubs.io.