Tech-savvy Volkswagen owner has uncovered critical security flaws in the My Volkswagen app that potentially exposed sensitive personal data and vehicle information of thousands of customers.
The vulnerabilities, which have since been patched, allowed anyone with access to a vehicle’s VIN number to retrieve comprehensive owner data, service records, and potentially control connected features without authorization.
The security researcher discovered the vulnerabilities in 2024 after purchasing a pre-owned Volkswagen vehicle.
When attempting to set up the My Volkswagen app, they encountered a problem: the four-digit verification OTP was being sent to the previous owner’s phone.
After failed attempts to contact the former owner, the researcher noticed the app didn’t implement account lockout mechanisms after multiple incorrect OTP entries.
Using Burp Suite to intercept network traffic and a custom Python script to systematically test all 10,000 possible combinations, they successfully bypassed the verification process.
The script quickly found the valid code, granting full access to the vehicle in the app.
This brute-force attack demonstrated a fundamental authentication weakness that could allow unauthorized individuals to access any Volkswagen vehicle in the system.
Personal Data Exposure Through VIN Number
Following the successful authentication, the researcher discovered multiple critical API vulnerabilities.
By examining the app’s network traffic, they identified endpoints that leaked extensive user data accessible with just a vehicle’s VIN number – information visible through a car’s windshield.
Soon enough, I could inspect all the requests the app was sending over the internet. While sifting through these requests looking for my OTP, I discovered several other interesting API calls, which I’ll discuss below.
The exposed information included owners’ full names, phone numbers, email addresses, physical addresses, vehicle details, and service records.
More concerning endpoints revealed internal system credentials in cleartext, complete service histories with customer feedback, and in some cases even driving license numbers and education qualifications.
This represents a significant privacy violation that could enable stalking, sophisticated phishing attacks, and identity theft.
An API endpoint exposed Passwords, Tokens, and Usernames for various internal services in cleartext, this included internal applications, payment processing details and even CRM tools like salesforce.
Volkswagen’s Response Timeline
The security researcher responsibly reported the findings to Volkswagen’s security team on November 23, 2024, after locating the appropriate contact through the company’s security.txt file.
The company acknowledged the report within four days, beginning a three-month remediation process.
Communication continued throughout early 2025, with Volkswagen requesting the researcher sign an NDA on April 3 to facilitate more detailed technical discussions.
By May 6, 2025, Volkswagen confirmed that all identified vulnerabilities had been successfully patched, addressing the serious privacy concerns.
While the researcher received no financial bounty for their efforts, they expressed satisfaction in contributing to improved security for Volkswagen users.
This incident highlights the importance of robust authentication mechanisms and proper API security in automotive connectivity features, especially as vehicles become increasingly integrated with digital services.
The case serves as a reminder that as vehicles integrate more deeply with internet-connected services, manufacturers must implement stringent security testing to protect sensitive customer information from potential exploitation.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
