ForgeRock Attack Chain: Default admin:admin Felix Console Credentials and WAF Path-Encoding Bypass Lead to RCE and Remote Vehicle Unlock at Two Automakers

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5554 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ForgeRock OpenIDM Felix Web Console Access (/system/console) incl. Encoded Paths — Exploitation

TL-2026-5554 ForgeRock Attack Chain. Detects successful HTTP responses for requests that, after URL-decoding and removal of path parameters, resolve to the Apache Felix Web Console root /system/console on OpenIDM/Jetty hosts. The researchers bypassed WAF URL blocking with encoded paths that Jetty still routed to the console, so the search normalizes the path before matching. Any successful console access from a non-management source is a strong exploitation signal (T1190) and typically precedes default admin:admin use (T1078.001).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1078.001
• Data sources: splunk:index=web sourcetype=access_combined (Jetty/OpenIDM request log), CommonSecurityLog (WAF/reverse proxy CEF), webserver access logs
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h
| eval norm_path=lower(urldecode(urldecode(coalesce(uri_path, uri))))
| eval norm_path=replace(norm_path, ";[^/?]*", "")
| where like(norm_path, "%/system/console%")
| eval console_success=if(match(status, "^(200|302|304)$"), 1, 0)
| stats count AS requests, sum(console_success) AS successes, dc(norm_path) AS distinct_paths, values(norm_path) AS paths, values(status) AS statuses, min(_time) AS first_seen, max(_time) AS last_seen BY clientip, host
| where successes>0
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
| table first_seen last_seen clientip host requests successes distinct_paths paths statuses

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| extend NormPath = tolower(url_decode(url_decode(RequestURL)))
| extend NormPath = replace_regex(NormPath, @';[^/?]*', '')
| where NormPath contains '/system/console'
| where DeviceAction !in~ ('Blocked', 'Block', 'Deny', 'Denied', 'Dropped')
| summarize Requests = count(), Paths = make_set(NormPath, 20), Actions = make_set(DeviceAction, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationHostName
| project FirstSeen, LastSeen, SourceIP, DestinationHostName, Requests, Paths, Actions

Sigma

title: Apache Felix Web Console Access on OpenIDM Jetty Server
id: 3f1c2a7e-5b4d-4e8a-9c21-7a6d0e1b2c01
status: experimental
description: Detects successful HTTP responses for requests to the Apache Felix Web Console root /system/console on ForgeRock OpenIDM hosts. Part of the TL-2026-5554 chain where default admin credentials and a WAF path-encoding bypass exposed the console.
references:
    - https://samcurry.net/forgerock
    - https://docs.pingidentity.com/pingidm/7.2/security-guide/security-remove-dev-tools.html
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1078.001
logsource:
    category: webserver
detection:
    selection_path:
        c-uri|contains:
            - '/system/console'
            - '%2fsystem%2fconsole'
    selection_status:
        sc-status:
            - 200
            - 302
            - 304
    condition: selection_path and selection_status
falsepositives:
    - Administrators legitimately managing OSGi bundles through the console from a management network
level: high

Known false positives:

• Authorized administrators using the Felix console from a management network
• Vulnerability scanners probing /system/console during scheduled scans

Tuning notes: Point index/sourcetype at the Jetty or reverse-proxy request log for OpenIDM hosts. Exclude known management subnets and scanner IPs via a lookup. In production the console should be removed, so any success is alertable. Sources that log only the pre-WAF URL will miss encoded variants hitting the backend, so also ingest backend Jetty logs.

• 🔒 Felix Web Console Request Authenticated as Default 'admin' Account — Default Credentials · unlock with TL Creds
• 🔒 OpenIDM JVM Spawning Shell or Download Utility — RCE via Injected Bundle/Groovy · unlock with TL Creds
• 🔒 Local OpenIDM Admin-Header API Call from Command Line — Credential Use for Customer Records API · unlock with TL Creds
• 🔒 Encoded or Obfuscated Felix Console Path Requests — WAF Path-Normalization Bypass · unlock with TL Creds
• 🔒 New JAR Written to OpenIDM bundle Directory — OSGi Bundle Installation · unlock with TL Creds
• 🔒 OpenIDM Scheduler Configuration Created with Groovy Script — Scheduled Job RCE · unlock with TL Creds
• 🔒 POST to Felix ConfigMgr or Bundle Manager on OpenIDM — Scheduler/Script Config Creation · unlock with TL Creds
• 🔒 Admin-Run Customer Email/Password Change Followed by Token Issuance — Account Takeover · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5554.

Technical analysis

The work was controlled research, not a criminal campaign, and both automakers fixed the issue about two hours after the report.

In research disclosed on 2026-11-07 (reported by Cyber Security News on 2026-11-09), Shubham Shah and Sam Curry described a chain of weaknesses in ForgeRock identity infrastructure (Access Management for login sessions and OpenIDM/Identity Management for customer records) at two anonymized automakers ("Automaker #1" and "Automaker #2"). The issues were found in early 2026. No CVE has been assigned or cited in the sources.

The chain began when the researchers traced an email-validation request back to administrative services running alongside OpenIDM, including the Apache Felix Web Console. A web application firewall blocked direct requests to the console. The researchers found that specially encoded paths made requests look like static-file requests at the edge, while the backend Jetty server handled them as Felix Web Console requests. The write-up attributes this to a path-normalization mismatch among the edge WAF, Jetty servlet path resolution, Felix plugin routing and OpenIDM CREST path parsing. The exact encodings are intentionally not reproduced in this record.

The Felix console accepted the documented default credential pair admin/admin. Apache Felix documents username and password defaults of admin for the OSGi management console (manager.root /system/console), and Ping Identity's PingIDM 7.2 guidance states the defaults in conf/felix.webconsole.json are admin/admin and that the console's authentication is separate from IDM's. Using the console's Configuration Manager (ConfigMgr), the researchers created an OpenIDM scheduled job that ran Groovy code. That code installed a small Java bundle in the running service that exposed a controlled command endpoint, which is remote code execution on the identity server (not on the vehicles). The bundle inventory reportedly showed Apache Felix 7.0.1.

From the server the researchers obtained administrative credentials for local requests to the customer-records API. With these they changed a test account's email and password, received the email verification and OTP codes at the attacker-controlled address, and completed login. They exchanged the resulting session for tokens accepted by the vehicle APIs, which exposed vehicles, location, telemetry, remote lock/unlock and remote engine start/stop. The write-up also cites weak OTP handling and client-controlled device and push-token registration. Restoring the original email did not invalidate the newly minted tokens. Testing was limited to US accounts and vehicles (verified only with the owner present), although the identity systems served multiple regions.

Both automakers' product security teams fixed the issue about two hours after receiving the report, removing the proof bundle and rotating the affected credentials. Defender lessons: remove or protect the Felix console and change default credentials (Ping Identity guidance: delete org.apache.felix.webconsole*.jar and the openidm-felix-webconsole jar from the bundle directory and delete felix.webconsole.json, or change the credentials in felix.webconsole.json); do not rely on WAF URL blocking to protect administrative services; normalize paths consistently across edge, container and application; restrict who can create scheduled scripts and disable script engines in production; require step-up verification for email and password changes; and revoke tokens when account details change.

MITRE ATT&CK techniques by tactic:

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter

Initial Access

T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation; T1505 Server Software Component

lateral-movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Credential Access

T1552 Unsecured Credentials

Remediation

Patches

• No CVE or vendor patch cited; both affected automakers remediated by removing the proof bundle and rotating credentials about two hours after the report
• Follow Ping Identity PingIDM security guide: remove dev tools from production

Immediate actions

• Inventory ForgeRock/PingIDM/OpenIDM deployments and check whether /system/console (Apache Felix Web Console) is reachable from any network path, including via encoded paths through WAF/CDN
• Change the Felix console username/password in conf/felix.webconsole.json (defaults are admin/admin) or remove the console
• Rotate administrative and service credentials that were stored on or reachable from identity servers
• Review OpenIDM scheduler configuration for unexpected scheduled jobs running Groovy/script code and for unknown OSGi bundles

Workarounds

• Restrict Felix Web Console to localhost or a management network at the listener level, not only at the WAF
• Clear the console username property to disable HTTP Basic authentication for the console where appropriate

Longer-term hardening

• Remove development tools from production IDM: delete org.apache.felix.webconsole*.jar and the openidm-felix-webconsole jar from the bundle directory and felix.webconsole.json from conf/
• Normalize and validate request paths consistently across WAF, servlet container (Jetty) and application (CREST)
• Disable or restrict script engines and scheduled-script creation in production identity servers
• Require step-up verification for email and password changes and bind device/push-token registration to server-verified device identity
• Revoke all issued sessions and tokens when email, password or other account attributes change
• Do not treat WAF URL blocking as a substitute for securing the administrative service behind it

Affected and fixed versions

• ForgeRock / Ping Identity — ForgeRock Identity Management (OpenIDM) with Apache Felix Web Console enabled
  Vulnerable versions: Deployments with the Felix Web Console reachable and default admin/admin credentials (specific versions not stated in sources)
  Fixed in: Not applicable: remediated by configuration (credential rotation, bundle removal)
• ForgeRock / Ping Identity — ForgeRock Access Management
  Vulnerable versions: Specific versions not stated in sources
  Fixed in: Not stated
• Apache Software Foundation — Apache Felix Web Console
  Vulnerable versions: 7.0.1 (as reported in the bundle inventory); default admin/admin credentials
  Fixed in: Change default credentials or remove console
• Eclipse Foundation — Jetty (backend web server handling encoded paths)
  Vulnerable versions: Specific versions not stated in sources
  Fixed in: Not stated

Timeline

• 2026-01-01 Both automakers fixed the issue about two hours after the report, removing the proof bundle and rotating affected credentials (exact date not stated; approximate placeholder).
• 2026-01-01 Findings were reported to both automakers' product security teams (early 2026; exact date not stated).
• 2026-01-01 Production access was validated and the chain demonstrated against US test accounts and vehicles at two automakers (early 2026; exact date not stated).
• 2026-01-01 Researchers identified the ForgeRock/Felix chain in early 2026 (exact date not stated in sources; date is an approximate placeholder for 'early 2026').
• 2026-11-07 Shubham Shah and Sam Curry published the technical report on samcurry.net/forgerock.
• 2026-11-09 Cyber Security News published coverage of the ForgeRock attack chain.

Sources cited

• Apache Felix Web Console: Configuration Manager default path /system/console/configMgr (same documentation page) felix.apache.org · Advisory
• Shubham Shah and Sam Curry technical report: ForgeRock samcurry.net · Research · 2026-11-07
• PingIDM 7.2 Security Guide: Remove development tools docs.pingidentity.com · Vendor report
• Apache Felix Web Console documentation felix.apache.org · Vendor report
• Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars cybersecuritynews.com · News · 2026-11-09

More in vulnerability

• CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218
• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline
• Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')
• "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux
• WidzialniCMS < 2.5 unauthenticated file upload RCE (CVE-2026-110468, CVE-2026-110469) plus reflected XSS (CVE-2026-112204) and login lockout bypass (CVE-2026-112205)