Watch the video, transcript and sources
https://www.youtube.com/watch?v=vACPEdgpiMk
+ Connected-car research published November 7
- Administrative identity boundaries failed in the reported chains
+ The US companion reports same-day remediation after disclosureA car app can unlock a door because its online services believe the signed-in customer owns that vehicle. Shubham Shah and Sam Curry describe research that reached the administrative machinery defining that customer identity. From there, they obtained the same app authority as an owner and demonstrated supported remote commands on permissioned vehicles.
The physical car was at the end of an ordinary web identity chain. That is the useful answer for developers: review the services allowed to change the account facts that downstream authorization trusts.
What is new, and what was already fixed?
Both primary writeups appeared on November 7. Curry dates his research and disclosure to early 2026. Shah describes Australian research beginning in July. They have different timelines and different stated scopes; the publication date does not make the discovery new.
Curry reports that two unnamed automakers fixed the reported vulnerability approximately two hours after receiving the report and rotated affected credentials. His complete account-to-vehicle tests used US accounts and vehicles, while the affected identity directories served multiple regions.
Shah describes an Australian demonstration involving one unnamed automaker across two brands, then claims broader combined reach. His article supplies no matching remediation timeline and leaves the current Australian remediation status unspecified. That missing date gives us no basis to claim an ongoing vulnerability. We also cannot turn the US companion's response time into a worldwide repair deadline met by every region.
The authority behind a tap
An app completes customer sign-in, obtains the tokens its services expect, and loads the customer's garage. The service uses the account-to-vehicle relationship to decide which commands are available. Control of the trusted identity record can therefore carry consequences beyond account data.
In Shah's Australian account, management interfaces relied on keys delivered in browser JavaScript. He also reports administrator credentials in a vendor bundle that worked in production. The browser is an enthusiastic distribution mechanism for something labelled secret.
The US companion describes an edge filter and identity backend interpreting a request differently. A route treated as static content at the edge reached administration tooling in the backend. That tooling ultimately allowed code to execute inside the identity service and reach customer records behind the public filtering boundary.
This newsletter keeps the explanation conceptual. It contains no executable request sequence, credentials, encoded paths or live targeting instructions.
Separate logins, separate authorities
The versioned PingIDM 7.2 production guide tells operators to remove or protect development and debug tools. It specifically says the console's authentication is separate from the identity product's authentication. Inventorying only the customer login can leave another administrative login outside the review.
Administrator access, a completed customer session and a mobile app token have different roles. Treating them as one interchangeable token conceals the boundary each service relies on.
The regional multi-factor findings differ too. In the US account, administrative control over identity records affected the login information and the destination for verification. Shah describes a separate Australian authentication misconfiguration. Ordinary multi-factor protection still matters; the systems defining its owner and verification route also need protection.
The proof reached the driveway
Curry explicitly distinguishes an accepted API command from physical action. The researchers refreshed vehicle status and confirmed the result with the owner standing beside the vehicle. Shah unlocked and started it, then stopped the engine and locked it again.
That is a more useful test result than a successful response on a laptop. These were permissioned demonstrations reported by the researchers. We did no automotive testing ourselves.
Remote capabilities depend on the model, subscription and active connected services. Neither primary establishes driving away or defeating an immobilizer. The research supports particular app capabilities and the stated physical tests.
Phone unlocking has legitimate uses. The HN discussion mentions checking a forgotten lock and warming or cooling a car. Customers can reasonably want those features while expecting the service to protect the authority it holds.
Verdict: NEEDS REVIEW
I'd audit administrative paths into customer identity before trusting them with physical controls. The reported US fix deserves credit. For your application, ask which service can redefine the owner that downstream systems believe.
Sources
Cover credit
Sam Curry portrait by Magistr8, Wikimedia Commons, CC0. Cropped, background-masked and resized without generated details. His official About page corroborates the identity. Photograph date unspecified; no endorsement or current-reaction claim. Cover contains the portrait and two huge words only. No film/GIF or anime meme is reproduced in this written edition.
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
Video media credits
The accompanying video uses a ScreenJunkies/GIPHY Jurassic Park caricature, whose native source links to ScreenJunkies, and the Imgflip Pigeon template. Each is a silent excerpt or still of at most two seconds, transformed as fictional process commentary. Neither depicts an actual automaker reaction. Hosting and publisher provenance grant no blanket reuse licence or legal clearance. These assets are not reproduced in this written edition.