All vulnerabilities
CVE-2026-109566

rapyd-admin: Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder

zofe rapyd-admin
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.44%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.20.0Fixed versionCVE List
Published12 Oct 2026Updated 12 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.

Text from CVE List

Affected versions 2

  • rapyd-adminaffected: 9.0.0 before 9.20.0CVE List
  • rapyd-adminunaffected: 9.20.0CVE List

References 5