# ForgeRock Attack Chain: Default admin:admin Felix Console Credentials and WAF Path-Encoding Bypass Lead to RCE and Remote Vehicle Unlock at Two Automakers

> Researchers Shubham Shah and Sam Curry chained a WAF path-encoding bypass (requests Jetty handled as Apache Felix Web Console requests) with still-active default admin:admin credentials to reach the Felix ConfigMgr on ForgeRock OpenIDM servers at two unnamed automakers. This gave remote code execution on the identity servers, test-account takeover, and tokens accepted by vehicle APIs for remote unlock, lock, start and stop. The work was controlled research, not a criminal campaign, and both automakers fixed the issue about two hours after the report.

- **Published:** 2026-11-09T13:27:37Z
- **Last reviewed:** 2026-11-09T13:27:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5554
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5554.png
- **ID:** TL-2026-5554
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 5

## Description

In research disclosed on 2026-11-07 (reported by Cyber Security News on 2026-11-09), Shubham Shah and Sam Curry described a chain of weaknesses in ForgeRock identity infrastructure (Access Management for login sessions and OpenIDM/Identity Management for customer records) at two anonymized automakers ("Automaker #1" and "Automaker #2"). The issues were found in early 2026. No CVE has been assigned or cited in the sources.

The chain began when the researchers traced an email-validation request back to administrative services running alongside OpenIDM, including the Apache Felix Web Console. A web application firewall blocked direct requests to the console. The researchers found that specially encoded paths made requests look like static-file requests at the edge, while the backend Jetty server handled them as Felix Web Console requests. The write-up attributes this to a path-normalization mismatch among the edge WAF, Jetty servlet path resolution, Felix plugin routing and OpenIDM CREST path parsing. The exact encodings are intentionally not reproduced in this record.

The Felix console accepted the documented default credential pair admin/admin. Apache Felix documents username and password defaults of admin for the OSGi management console (manager.root /system/console), and Ping Identity's PingIDM 7.2 guidance states the defaults in conf/felix.webconsole.json are admin/admin and that the console's authentication is separate from IDM's. Using the console's Configuration Manager (ConfigMgr), the researchers created an OpenIDM scheduled job that ran Groovy code. That code installed a small Java bundle in the running service that exposed a controlled command endpoint, which is remote code execution on the identity server (not on the vehicles). The bundle inventory reportedly showed Apache Felix 7.0.1.

From the server the researchers obtained administrative credentials for local requests to the customer-records API. With these they changed a test account's email and password, received the email verification and OTP codes at the attacker-controlled address, and completed login. They exchanged the resulting session for tokens accepted by the vehicle APIs, which exposed vehicles, location, telemetry, remote lock/unlock and remote engine start/stop. The write-up also cites weak OTP handling and client-controlled device and push-token registration. Restoring the original email did not invalidate the newly minted tokens. Testing was limited to US accounts and vehicles (verified only with the owner present), although the identity systems served multiple regions.

Both automakers' product security teams fixed the issue about two hours after receiving the report, removing the proof bundle and rotating the affected credentials. Defender lessons: remove or protect the Felix console and change default credentials (Ping Identity guidance: delete org.apache.felix.webconsole*.jar and the openidm-felix-webconsole jar from the bundle directory and delete felix.webconsole.json, or change the credentials in felix.webconsole.json); do not rely on WAF URL blocking to protect administrative services; normalize paths consistently across edge, container and application; restrict who can create scheduled scripts and disable script engines in production; require step-up verification for email and password changes; and revoke tokens when account details change.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Valid Accounts: Default Accounts
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1505 Server Software Component
- T1552 Unsecured Credentials
- T1098 Account Manipulation
- T1550.001 Use Alternate Authentication Material: Application Access Token

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ForgeRock OpenIDM Felix Web Console Access (/system/console) incl. Encoded Paths — Exploitation** (`TL-2026-5554-SPL-001`)

TL-2026-5554 ForgeRock Attack Chain. Detects successful HTTP responses for requests that, after URL-decoding and removal of path parameters, resolve to the Apache Felix Web Console root /system/console on OpenIDM/Jetty hosts. The researchers bypassed WAF URL blocking with encoded paths that Jetty still routed to the console, so the search normalizes the path before matching. Any successful console access from a non-management source is a strong exploitation signal (T1190) and typically precedes default admin:admin use (T1078.001).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1078.001
- **Data sources:** splunk:index=web sourcetype=access_combined (Jetty/OpenIDM request log), CommonSecurityLog (WAF/reverse proxy CEF), webserver access logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=access_combined earliest=-24h
| eval norm_path=lower(urldecode(urldecode(coalesce(uri_path, uri))))
| eval norm_path=replace(norm_path, ";[^/?]*", "")
| where like(norm_path, "%/system/console%")
| eval console_success=if(match(status, "^(200|302|304)$"), 1, 0)
| stats count AS requests, sum(console_success) AS successes, dc(norm_path) AS distinct_paths, values(norm_path) AS paths, values(status) AS statuses, min(_time) AS first_seen, max(_time) AS last_seen BY clientip, host
| where successes>0
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
| table first_seen last_seen clientip host requests successes distinct_paths paths statuses
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| extend NormPath = tolower(url_decode(url_decode(RequestURL)))
| extend NormPath = replace_regex(NormPath, @';[^/?]*', '')
| where NormPath contains '/system/console'
| where DeviceAction !in~ ('Blocked', 'Block', 'Deny', 'Denied', 'Dropped')
| summarize Requests = count(), Paths = make_set(NormPath, 20), Actions = make_set(DeviceAction, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationHostName
| project FirstSeen, LastSeen, SourceIP, DestinationHostName, Requests, Paths, Actions
```

### Sigma

```yaml
title: Apache Felix Web Console Access on OpenIDM Jetty Server
id: 3f1c2a7e-5b4d-4e8a-9c21-7a6d0e1b2c01
status: experimental
description: Detects successful HTTP responses for requests to the Apache Felix Web Console root /system/console on ForgeRock OpenIDM hosts. Part of the TL-2026-5554 chain where default admin credentials and a WAF path-encoding bypass exposed the console.
references:
    - https://samcurry.net/forgerock
    - https://docs.pingidentity.com/pingidm/7.2/security-guide/security-remove-dev-tools.html
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.initial-access
    - attack.t1190
    - attack.t1078.001
logsource:
    category: webserver
detection:
    selection_path:
        c-uri|contains:
            - '/system/console'
            - '%2fsystem%2fconsole'
    selection_status:
        sc-status:
            - 200
            - 302
            - 304
    condition: selection_path and selection_status
falsepositives:
    - Administrators legitimately managing OSGi bundles through the console from a management network
level: high
```

**Known false positives:**

- Authorized administrators using the Felix console from a management network
- Vulnerability scanners probing /system/console during scheduled scans

**Tuning notes:** Point index/sourcetype at the Jetty or reverse-proxy request log for OpenIDM hosts. Exclude known management subnets and scanner IPs via a lookup. In production the console should be removed, so any success is alertable. Sources that log only the pre-WAF URL will miss encoded variants hitting the backend, so also ingest backend Jetty logs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Felix Web Console Request Authenticated as Default 'admin' Account — Default Credentials (locked: unlock with TL Creds)
- OpenIDM JVM Spawning Shell or Download Utility — RCE via Injected Bundle/Groovy (locked: unlock with TL Creds)
- Local OpenIDM Admin-Header API Call from Command Line — Credential Use for Customer Records API (locked: unlock with TL Creds)
- Encoded or Obfuscated Felix Console Path Requests — WAF Path-Normalization Bypass (locked: unlock with TL Creds)
- New JAR Written to OpenIDM bundle Directory — OSGi Bundle Installation (locked: unlock with TL Creds)
- OpenIDM Scheduler Configuration Created with Groovy Script — Scheduled Job RCE (locked: unlock with TL Creds)
- POST to Felix ConfigMgr or Bundle Manager on OpenIDM — Scheduler/Script Config Creation (locked: unlock with TL Creds)
- Admin-Run Customer Email/Password Change Followed by Token Issuance — Account Takeover (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Hackers Used Default admin:admin Credentials to Exploit ForgeRock RCE and Remotely Unlock Cars](https://cybersecuritynews.com/forgerock-attack-chain/)
- [Shubham Shah and Sam Curry technical report: ForgeRock](https://samcurry.net/forgerock)
- [PingIDM 7.2 Security Guide: Remove development tools](https://docs.pingidentity.com/pingidm/7.2/security-guide/security-remove-dev-tools.html)
- [Apache Felix Web Console documentation](https://felix.apache.org/documentation/subprojects/apache-felix-web-console.html)
- [Apache Felix Web Console: Configuration Manager default path /system/console/configMgr (same documentation page)](https://felix.apache.org/documentation/subprojects/apache-felix-web-console.html#configuration-manager)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5554