Security researchers uncovered a severe vulnerability in Subaru’s Starlink service that could have allowed attackers to take over accounts and control vehicles in the U.S., Canada, and Japan using only a license plate. Discovered by Sam Curry and Shubham Shah in November 2024, the flaw enabled unauthorized access to customer accounts, allowing hackers to start or stop vehicles, retrieve precise location data, access location history, and obtain sensitive personal information. The issue stemmed from a “resetPassword.json” API endpoint that lacked adequate security measures, making it possible to bypass two-factor authentication and gain full access to the admin dashboard. The researchers demonstrated the vulnerability’s potential, which Subaru patched within 24 hours of being notified. Fortunately, there is no evidence that the flaw was exploited maliciously. Similar issues have also been identified in other vehicle systems, like Kia’s dealer portal.