CVE-2026-109566: Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rapyd Adminto a version that resolves this vulnerability.Fixed in 9.20.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Rapyd Admin installations from 9.0.0 before 9.20.0 are affected when the setup installer has seeded the AuthSeeder-created admin@laravel account. The account is also silently re-created whenever rpd:make runs.
What does an attacker need to exploit this issue?
An attacker needs network access to the Rapyd Admin login interface. No prior authentication, privileges, or user interaction is required; the attacker can log in with the seeded admin@laravel account using the password admin.
What access does successful exploitation provide?
Successful login provides global super-admin access. This bypasses per-record authorization and tenant scoping, with high impact to confidentiality, integrity, and availability.
What should be checked if patching cannot happen immediately?
Check whether the admin@laravel account exists and whether rpd:make has been run, as it can silently recreate the account. Remove or disable the seeded account and prevent access to the administrative login interface until the affected installation can be updated to 9.20.0 or later.