CVE-2026-109566
CriticalCVSS 9.8Summary
Rapyd Admin versions 9.0.0 before 9.20.0 contain hard-coded credentials that allow remote unauthenticated attackers to gain super-admin access through an admin@laravel account with password admin. The account is seeded by the installer and silently re-created on every rpd:make run, bypassing authorization and tenant scoping.
Risk Assessment
An attacker can gain full control over the application, including access to all data and administrative functions, posing a severe security threat.
Recommendation
Upgrade Rapyd Admin to version 9.20.0 or later. Immediately change or remove the default admin@laravel account and enforce strong authentication.
Other vulnerabilities in Rapyd Admin
See all- CVE-2026-109567High
Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.
- CVE-2026-109565Medium
Rapyd Admin from version 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.
Original NVD description (English source)
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS