Car dealer portal flaw exposes data and enables remote car unlocks

A security researcher found weaknesses in a dealer portal that could give attackers access to customer data and the ability to unlock vehicles remotely.

Security flaws in a carmaker portal expose data and enable remote car unlocks

A security researcher, Eaton Zveare of Harness, discovered flaws in a carmaker’s centralized dealer portal. The bugs could let an attacker create a new admin account with unfettered access, letting them view personal and financial data, tracking vehicles, and enrolling owners in features that allow remote control of some car functions. The vulnerability arose from a login process that could be bypassed by loading and altering code in the user’s browser.

Zveare demonstrated that the admin account could access more than 1,000 dealer accounts across the United States and described tools within the portal that could be used to look up vehicle data and owner information with minimal identifiers. The portal’s single sign-on links multiple dealer systems, raising the risk that an attacker could move between systems and impersonate other users. While the researcher did not test theft in the real world, he warned that the flaws could be exploited to break into vehicles or disrupt shipments. The carmaker fixed the issues within about a week after disclosure, and there were no reports that the flaws had been exploited in the wild.

The incident highlights how a single authentication weakness can cascade into broad access across a dealer network. When a system strains to connect multiple portals under one login, it creates a single point of failure that can be abused to surface sensitive data and interfere with vehicle functions. The lesson is not just about one portal; it is about governance. Carmakers often rely on third party vendors and complex integrations, which increases the attack surface. Stronger authentication, least privilege access, and regular security testing should be mandatory, not optional. The episode also tests trust: customers expect privacy and safety, not a potential doorway for misuse.

Highlights

Security should be baked into every connected car path, not treated as an afterthought.