I now have full remote control of over 20 Tesla’s in 10 countries

This is pretty much expected.

The Tesla API was _really_ not designed for 3rd-party use. For one, it uses OAuth, but only one client is registered with it, and its client ID and secret are extremely well known. This is extremely problematic if you wrote some automation against your car but forgot to not commit your access/refresh tokens.

Fortunately, they are revocable with a single POST, though I haven't tried it: https://www.teslaapi.io/authentication/oauth

So I don't need the actual car keys to control someone else's Tesla remotely from anywhere in the world?

Is that why Tesla knows about this backdoor and can remotely access to your own car given the OTA updates and now this?

Oh dear.

Did anyone find any details/proof in the thread?