Security researchers Shubham Shah and Sam Curry found a way for hackers to remotely unlock and even start certain cars just by exploiting flaws in the automakers' back-end systems.
Their demonstration also revealed that personal information and real-time car data could be exposed if these weaknesses aren't fixed.
Misconfigured ForgeRock allowed unauthorized door unlocks
The issue came down to weak user authentication, thanks to misconfigured implementation of ForgeRock from the automakers.
By tricking the system with their own access tokens sent between mobile apps and back-end servers, the researchers could send "door-unlock" requests without permission.
The car companies have since patched things up (though the researchers didn't name them, the second automaker might be Toyota), but this whole episode is a wake-up call for stronger security in connected cars.