CVE-2026-49322 describes a weak authentication vulnerability in the Wireless Control Module of the 2025 Indian Motorcycle Scout Bobber + Tech. An attacker with read access to the in-vehicle network and proximity to the motorcycle can passively observe one PIN authentication exchange. Due to the use of a non-cryptographic operation in the authentication protocol, the attacker can mathematically derive the user-set unlock PIN from the captured data. Specific protocol details are withheld pending vendor remediation. No official patch or remediation level has been published yet.

Successful exploitation allows an adjacent-network attacker to recover the unlock PIN, potentially bypassing the motorcycle's primary user authentication. This compromises confidentiality of the PIN but does not affect integrity or availability. The attacker requires proximity and read access to the in-vehicle network, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit physical proximity and network access to the motorcycle's in-vehicle network to trusted parties only.