by rd95

Mr Hunt discovered that anyone can control the heating and air conditioning systems of a stranger's Leaf by sending it commands via a web browser because the car's companion app was not configured to verify the owner's identity.

Instead, it only required a vehicle identification number (Vin).

Wow. That's one hell of an oversight.