CVE-2026-109566 Details
Description
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
A hard-coded credentials vulnerability has been identified in Rapyd Admin versions 9.0.0 prior to 9.20.0. This vulnerability allows remote, unauthorized attackers to gain super-admin access through an account created by the AuthSeeder. The account, 'admin@laravel', is seeded by the setup installer and is silently recreated with a known password, 'admin', every time the 'rpd:make' command is run. This allows attackers to log in as a global super admin, bypassing per-record authorization and tenant scoping.
Users should update to Rapyd Admin version 9.20.0 or later, change the password for the 'admin@laravel' account, and review any user names or rich-text values that may contain markup.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zofe Rapyd Admin | >= 9.0.0, < 9.20.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |