Researchers found automaker customer portals still running ForgeRock OpenIDM with the documented default admin/admin password on the built-in console, The Hacker News reports. ForgeRock’s own hardening guide says to remove or protect that console before going live.
What to take from it
- The console wasn’t meant to face the open internet, but a path-parsing mismatch let researchers reach it anyway.
- Inside, a built-in scheduler could run scripts with admin rights.
- I’m not walking through the method. The lesson is the same one every hardening guide screams: change default credentials, remove admin consoles from production, and don’t trust the edge to rewrite paths the same way your app does.
My take
If you run identity or customer platforms, audit for vendor defaults this week. Default passwords are still how doors get opened.
God Bless, and Use the Source!
