{"id":"CVE-2026-109566","published":"2026-10-12T21:17:13.190","lastModified":"2026-10-16T19:18:44.867","description":"Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-798"],"vendors":[],"products":[],"references":[{"url":"https://github.com/zofe/rapyd-admin","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/Modules/Auth/Database/Seeders/AuthSeeder.php#L29-L34","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0","tags":[]},{"url":"https://www.vulncheck.com/advisories/rapyd-admin-9.0.0-before-9.20.0-hard-coded-super-admin-credentials-via-authseeder","tags":[]}],"exploitRefs":[{"url":"https://github.com/zofe/rapyd-admin","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/Modules/Auth/Database/Seeders/AuthSeeder.php#L29-L34","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406a","tags":[]},{"url":"https://github.com/zofe/rapyd-admin/releases/tag/v9.20.0","tags":[]}],"hasPoc":true,"ai":{"summary":"A hard-coded admin account with password 'admin' exists in Rapyd Admin versions 9.0.0 through 9.19.0, allowing remote attackers to gain super-admin access without authentication. This vulnerability bypasses all per-record authorization and tenant scoping mechanisms.","exploitability":"Exploitation is extremely easy with no prerequisites - attackers simply need to access the login endpoint and use the hardcoded credentials admin@laravel/admin to gain full administrative control.","blast_radius":"The impact is severe as attackers can gain global super-admin access across all tenants and records, potentially leading to complete system compromise, data exfiltration, and privilege escalation across the entire application.","remediation":"Upgrade to Rapyd Admin 9.20.0 or later to fix the hard-coded credentials vulnerability.","detection":"Monitor authentication logs for failed login attempts with username 'admin@laravel' and password 'admin', particularly when these occur from external IP addresses, as well as any successful logins using this hardcoded account.","tags":["auth-bypass","hardcoded-credentials","web","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:47:36.790Z"}}