tl;dr: Security researchers chained several vulnerabilities in a major automaker's connected car platform to remotely unlock any of their vehicles in Australia (and later the US and Canada) using just a license plate number. The attack chain combined plate-to-VIN lookups, hardcoded OpenIDM admin credentials found in a JavaScript bundle, a GPT-assisted WAF path traversal bypass, and an MFA bypass via OAuth's Resource Owner Password Credentials flow. This allowed them to mint auth tokens for any user and issue commands like door-unlock and engine-start via the telematics API.