Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Rapyd‑Admin allows anyone to log in as super‑admin

CVE-2026-109566 · published 1 day ago
Summary

The Rapyd‑Admin tool (versions 9.0.0 through 9.19.x) creates a default admin account named admin@laravel with the password ‘admin’. Because this account is automatically recreated during setup, anyone who discovers it can sign in with full super‑admin rights, ignoring normal access controls. To protect your system, change or remove the default account and update to a version that no longer creates it.

What to do
  • Update zofe rapyd-admin to version 9.20.0 or later.
Affected software
VendorProductAffected versions
zofe rapyd-admin < 9.20.0
Original advisory text
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published12 Oct 2026
Updated14 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109566 · NVD
CVE-2026-109566 · MITRE
CVE-2026-109566 · OSV
Track software like this
Free during beta