On a connected product, an account takeover bug is a physical safety bug before it is a data one.
The Hacker News reports that two security researchers used a default admin:admin server password to take over the login systems sitting behind two car brands' mobile apps, which got them into any customer's account and, on a connected car, let them open its doors and start it. The same outlet reports that CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog: in GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex. It also reports that an attacker used a remote code execution flaw in SGLang to breach NEAR AI, taking data from 18 agents and about 100 users.
So: sweep your own identity infrastructure for default credentials, then rank every account takeover path by what it lets a stranger do in the physical world rather than by the records it exposes.
Security review of payment and account flows is something I take on as a focused engagement. A small one is days, not months, with cost and timeline back to you within a day. Tell me how your login path works today and I'll say where I would start.