Researcher reportedly unlocks electric scooter fleet via unsecured admin panel access

The event reveals how a single misconfigured frontend component can compromise an entire IoT fleet. The researcher identified the operator’s admin panel through subdomain enumeration, bypassing the lack of public links. While direct attacks on the panel’s authentication failed, the WordPress REST API exposed a valid admin identity, which the operational backend confirmed existed. This cross-system credential leakage demonstrates how observability gaps in one service can undermine security in another.

Authentication weaknesses formed the core vulnerability. The absence of rate limiting enabled brute-force attacks to succeed against the admin panel, while long-lived JWT sessions (950-day validity) extended the window for exploitation. These flaws contrast with the otherwise robust protections observed, such as SQL injection resistance and inaccessible source maps. For engineers, the incident illustrates how even well-defended systems can fail when authentication controls are inconsistent or overly permissive.

The operational impact of this access was significant. With a valid admin session, the researcher gained visibility into 83 endpoints covering vehicle unlocking, financial transactions, and IoT device management. While the article stops short of detailing actual scooter unlocks, the exposed functionality suggests full remote control was possible. This underscores the need for granular access controls and real-time monitoring in fleet management systems, where backend access can translate directly to physical device manipulation.