CVE-2026-109566: Rapyd Admin Hard-Coded Super-Admin Credentials via AuthSeeder
Rapyd Admin contains hard-coded credentials that let remote unauthenticated attackers reach super-admin access through a default account created by AuthSeeder. The record reports a CVSS 3.1 base score of 9.8 and a CWE-798 classification. No confirmed exploitation appears in the sources consulted.
Overview
Rapyd Admin, published by Zofe, contains hard-coded credentials classified as CWE-798. A seeder creates an admin@laravel account with the password admin, and according to the record this account grants remote unauthenticated attackers super-admin access. The account is recreated by the setup installer and by each rpd:make run.
Impact
- According to the record's description, remote unauthenticated access to a global super-admin account is possible.
- According to the record's description, the account bypasses per-record authorization and tenant scoping.
- The CVSS 3.1 base score of 9.8 (Critical) is reported by VulnCheck and GitHub. VulnCheck also reports a CVSS 4.0 score of 9.3.
Affected products and versions
- Zofe Rapyd-admin: from 9.0.0 up to but not including 9.20.0, as stated in the affected range of the record.
- The record's fixes field is empty. The end of the affected range and the release notes for 9.20.0 suggest that 9.20.0 is the first unaffected release. This is an inference.
Exploitation status
The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00439 (percentile 0.37152, dated 2026-10-23). This is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Upgrade to 9.20.0 or later, as the affected range and the release notes indicate.
- Until the upgrade is applied, remove the default admin account or change its credentials, and confirm that the seeder does not recreate it on later runs.
- Review administrative accounts across all tenants for the default identity and its recent logins.
- Limit access to administrative interfaces to trusted networks.
Detection guidance
- Search user tables for the default admin@laravel identity and review its login history.
- Monitor authentication logs for successful logins to administrative accounts from unexpected sources.
- Check whether deployment routines rerun the seeder, and alert on changes to that account.
Limitations of the available information
The sources do not describe the exact authentication path, the number of exposed deployments, or whether compromise has been observed. The record's source status is Deferred. Details beyond the cited references are unknown.
Frequently asked questions
What is the core weakness in CVE-2026-109566?
The record describes hard-coded credentials: a default admin@laravel account created by AuthSeeder with a known password, classified as CWE-798.
Which versions are affected?
The record gives the affected range as from 9.0.0 up to but not including 9.20.0 for Zofe Rapyd-admin.
Is this vulnerability known to be exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.