Remotely Unlocking Electric Scooters

The author identified the electric-scooter service’s backend by enumerating subdomains, discovering an unauthenticated Angular operator panel at panel.electricscootercompany.com.br that exposed 83 API endpoints for users, vehicles, trips, IoT devices and financial modules. By leveraging a publicly listed WordPress author (ID 1, “admin”), they brute-forced the panel login—thanks to absent rate limiting—and obtained a valid JWT granting admin-level (1000) access, revealing the system’s authentication weakness.