TL;DR
Get business pricing on garage and car supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A November 7, 2026 report by shubs describes a security investigation into a major automaker’s connected-car platform, conducted with researcher Sam Curry. The post says exposed administrative APIs could reveal account information and outlines how an authenticated token could control a vehicle, but the supplied report cuts off before explaining whether researchers obtained such a token, accessed cars, or how the automaker responded.
A security researcher writing as shubs says an investigation with Sam Curry found weaknesses in an unnamed automaker’s connected-car infrastructure, including publicly reachable administrative services and APIs that the researchers said exposed customer-account data. The post describes a possible route from a vehicle registration number to an account and explains that an authenticated app token can issue remote commands, but the supplied text ends before it establishes that the researchers obtained such a token or unlocked any vehicle.
Shubs says the investigation began by examining the mobile app used with a connected SUV purchased in 2023. By decompiling the app, the researchers reconstructed its requests and identified services hosted on the automaker’s telematics domain. One publicly reachable subdomain displayed a page titled “TEST HARNESS”, which the report identifies as an administrative tool.
According to the post, the tool’s JavaScript bundle revealed APIs that could interact with customer accounts and production vehicles. Shubs says some requests relied on API keys embedded in the application rather than additional authentication. The report describes ways to look up accounts by email and connect a vehicle identification number to a subscriber record, potentially exposing account details such as an email address.
The researchers say the admin tool’s available features did not, by themselves, give them remote control of a vehicle. The report then turns to the automaker’s identity system, describing an app sign-in flow involving multi-factor authentication and an authorization token used for telematics requests. Shubs writes that a valid token can be used for commands including locking or unlocking a car, sounding its horn, or controlling its engine. The supplied excerpt ends as the researchers describe examining the identity system; it does not include the next step or a confirmed result.
Customer Data and Remote Vehicle Controls
The reported weaknesses matter because connected-car apps link online accounts to physical vehicles. If the account-discovery methods described in the post were exploitable outside the researchers’ testing, exposed personal information could help an attacker identify a vehicle’s account holder. The report also describes remote commands as available to a holder of a valid authorization token, making the security of account authentication and token issuance central to vehicle access.
That does not establish that an unknown person could unlock any car from the brand, or that vehicles were accessed by an attacker. The article’s headline makes a broad claim, but the supplied technical account stops before showing how a token could be minted for another user. Readers should distinguish the researchers’ account of API weaknesses and a potential attack chain from proof of successful unauthorized vehicle control.
The report also raises questions about internet-facing test and administrative systems. Such services can support legitimate engineering and customer operations, but their exposure and access controls can affect the security of production accounts and vehicles. The findings described here may matter to customers, the automaker and other connected-car providers, although the available material does not establish the scale of exposure or any resulting harm.
Products Worth Considering
Autel MaxiSYS MS906 MAX Automotive Diagnostic Scanner, 10.1-Inch
Autel MaxiCheck MX808S Bidirectional OBD2 Diagnostic Scanner
Autel MaxiCOM MK808BT PRO Bidirectional OBD2 Diagnostic Scanner
As an affiliate, we earn on qualifying purchases.
How the Investigation Traced Access
Shubs says the investigation was carried out with Sam Curry in July, after the author began examining the connected-car platform linked to a vehicle bought in 2023. The post focuses on internet-facing web services rather than physical access to the car: its starting question was which infrastructure the mobile app contacted to perform a remote unlock.
The researchers describe following a sequence involving the app, telematics APIs and an identity provider using ForgeRock software. In the flow outlined in the post, a customer signs in through the identity service, completes multi-factor authentication and receives a token used for later requests. Separately, the report says a vehicle identification number could be connected to a subscriber record through APIs in the administrative tool. The supplied text does not include the full technical analysis, remediation details or any response from the automaker.
““Once you have that auth token, it’s pretty much game over.””
— Shubs, in the November 7, 2026 report
The Token Claim Remains Incomplete
The supplied report is an incomplete excerpt. It ends while describing files and the automaker’s identity system, before stating whether the researchers found a way to issue or obtain a token for another user. It therefore does not confirm that they remotely unlocked, locked or otherwise controlled a customer vehicle.
The automaker is not named in the supplied text, and the relevant web domains are redacted. The material also does not say whether the company was notified, whether the reported weaknesses were fixed, whether customer data was accessed beyond testing, or whether any customers were affected. The number of accounts or vehicles potentially exposed, the duration of any exposure and the precise scope of the APIs remain unknown.
Disclosure and Remediation Details Needed
The next useful developments would be the complete report and a statement from the automaker confirming whether the findings were reviewed and what corrective steps, if any, were taken. Details about responsible disclosure, timelines, affected services and independent verification would help establish whether the described weaknesses were limited to a test environment or could reach customer accounts and production vehicles.
Until those details are available, the report supports a cautious conclusion: researchers describe possible account-data exposure and a route to sensitive vehicle commands for an authenticated user, but the supplied text does not show a completed unauthorized-access chain. Customers can follow the automaker’s official security notices and use strong, unique account credentials and multi-factor authentication where offered; those steps do not resolve weaknesses in the company’s own systems.
Key Questions
Did the researchers unlock a customer’s car?
Not in the supplied excerpt. It says a valid app authorization token can enable remote commands, but it cuts off before confirming that the researchers obtained a token for another user or unlocked a vehicle.
Which automaker is the report about?
The source material refers to the company as “the automaker” and redacts its service domains. It does not identify the brand.
What information did the administrative APIs reportedly expose?
Shubs says the APIs could connect vehicle and subscriber records and retrieve account details, including an email address. The supplied text does not state how many accounts were accessible or whether customer data was taken outside the researchers’ testing.
Has the automaker fixed the reported weaknesses?
The supplied material does not say. It contains no company response, remediation timeline or confirmation that the services were changed.
When did the investigation take place?
The post was published on November 7, 2026, and says the collaboration took place in July. The excerpt does not specify the year for that July investigation.
Source: shubs.io
