Tata Motors iRA App Flaws Could Let Hackers Impersonate Car Owners and Access Vehicle Services

What happened?

Tata Motors’ iRA 2.0 and iRA.ev mobile apps contain four security flaws that could let attackers steal credentials, impersonate car owners, and access vehicle services. India’s Computer Emergency Response Team, CERT-In, rated the issues as High severity in an advisory published on November 4, 2026. The warning covers iRA 2.0 versions 26.7.3 and earlier, alongside iRA.ev versions 26.7.2 and earlier. These apps serve petrol, diesel, and electric vehicle customers, providing remote vehicle commands, status checks, health monitoring, and trip information.

Key details

• CERT-In issued a high severity advisory on November 4, 2026 covering four vulnerabilities in Tata Motors iRA apps.
• Hardcoded service account credentials, API keys, and authorization tokens are embedded in the app package and can be extracted without login.
• WebView insufficient origin checks allow malicious content to steal live bearer authentication tokens and impersonate owners.
• Authentication tokens are exposed in application logs used for development and debugging, requiring local log access to exploit.
• Security researcher Pranav Rajendran reported the vulnerabilities to CERT-In.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.