oh my god. it's just an API with no authn

This is like if accessing your email account just required knowing the email address

Wow that’s some KIAstone Kops shit right there

who even developed and approved this? an overworked intern?

For clarity, it has authentication, it doesn't have an extra tier for dealer vs user.

All your Kia are belong to us.

I wish we had more precise terms than "flaw" and "exploit" that gave the public a sense of how incredibly stupid this is