Kia dealer portal flaw could let attackers hack millions of cars

Researchers disclosed critical flaws in Kia's dealer web portal that could allow someone with a registered dealer account to generate access tokens, pull vehicle owner PII (name, email, phone, address), add themselves as a second user, and remotely control millions of Kia vehicles made after 2013 (lock/unlock/start/locate/honk). The team built a demonstration showing an attacker could act within ~30 seconds; the issues were reportedly fixed and no evidence of malicious exploitation was found.