Description
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
Published: 2026-10-12
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Remote Super‑Admin Access (Privilege Escalation)
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises from a hard‑coded super‑admin account seeded during installation. An unauthenticated attacker can exploit this to log in as ‘admin@laravel’ with password ‘admin’, gaining full system control and bypassing tenant isolation.

Affected Systems

Vendors: zofe; Product: Rapyd Admin. Versions affected: 9.0.0 through 9.19.9 (i.e., before 9.20.0).

Risk and Exploitability

CVSS 9.3 indicates critical severity. EPSS not available. Since KEV is not listed, no confirmed exploitation, but the credentials are trivially guessable and the seeder runs on each rpd:make, making exploitation straightforward. Attack vector is remote and unauthenticated, no privileges required to set up.

Generated by OpenCVE AI on October 12, 2026 at 22:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Rapyd Admin to version 9.20.0 or later to remove the hard‑coded credentials.
  • If upgrading is not immediately feasible, delete or comment out the AuthSeeder script and replace the default super‑admin credentials with a secure random password.
  • Restrict network access to installation and debugging interfaces, and enable logging to detect unauthorized login attempts.

Generated by OpenCVE AI on October 12, 2026 at 22:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
Title Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
Weaknesses CWE-798
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T20:55:19.825Z

Reserved: 2026-10-12T19:27:53.420Z

Link: CVE-2026-109566

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T21:17:13.190

Modified: 2026-10-12T21:17:13.190

Link: CVE-2026-109566

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T22:45:16Z

Weaknesses
  • CWE-798

    Use of Hard-coded Credentials