Tata Motors' iRA 2.0 and iRA.ev mobile apps have four security flaws that could enable attackers to steal credentials, impersonate car owners, and access vehicle services This article explores ira ev apps. . India's Computer Emergency Response Team (CERT-In) rated the issues as high severity, noting the vulnerabilities in versions 26.7.3 and earlier of iRA 2.0, and versions 26.7.2 and earlier of iRA.ev.
These apps cater to petrol, diesel, and electric vehicle customers, offering remote vehicle commands, status checks, health monitoring, and trip information.
Embedded Credentials and Stolen Tokens The initial vulnerability, CVE-2026-121144, pertains to service account credentials, API keys, and authorization tokens stored within the app package. This flaw underscores risks previously discussed in ZeroOwl’s reporting on hardcoded credentials in mobile apps. Insufficient checks on loaded URLs and their origins can allow malicious content to interact with app functions and obtain live bearer authentication tokens.
An attacker who gains access to exposed session tokens can misuse them to gain unauthorized access to vehicle information and services for the affected user. An attacker positioned to intercept network traffic can exploit this weakness to intercept or alter communications between the mobile application and its backend services. Previous research into automotive API vulnerabilities highlighted separate flaws affecting services across various manufacturers.
The risks it highlights concern sensitive information, user impersonation, and unauthorized data changes using owner privileges.
