CVE-2026-109566

Received Received - Intake

Hard-Coded Credentials in Rapyd Admin

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109566

Affected Vendors & Products

Vendor	Product	Version / Range
zofe	rapyd-admin	9.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

Rapyd Admin versions 9.0.0 to 9.20.0 have a hard-coded credentials vulnerability. This allows remote unauthenticated attackers to gain super-admin access using a pre-created admin account with username admin@laravel and password admin. The account is seeded during setup and recreated on every rpd:make run, bypassing authorization controls.

Detection Guidance

Check for the presence of the hard-coded admin account by inspecting the database for an account with email admin@laravel and password admin. Review application logs for repeated creation of this account during setup or rpd:make runs.

Impact Analysis

Attackers can log in as a global super admin, bypassing per-record authorization and tenant scoping. This grants full control over the system, allowing unauthorized access to sensitive data, system manipulation, and potential takeover of the entire application.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive data, which could lead to breaches of GDPR's data protection principles or HIPAA's access control requirements, resulting in legal and regulatory penalties.

Mitigation Strategies

Immediately change the default password for the admin@laravel account to a strong, unique password. Disable or remove the AuthSeeder functionality if it is not required. Update Rapyd Admin to version 9.20.0 or later to patch the vulnerability.

Hi! I’m here to help you understand CVE-2026-109566. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70