Rapyd Admin versions 9.0.0 through 9.19.x ship with a hard-coded admin@laravel / admin super-admin account that remote, unauthenticated attackers can use to take full control of the application.
What Is It
CVE-2026-109566 is a hard-coded credentials vulnerability (CWE-798) in Rapyd Admin, the Laravel admin package published as zofe/rapyd-admin. The setup installer's AuthSeeder creates an account with the email admin@laravel and the password admin. The account isn't created just once. Every run of the rpd:make command silently re-creates it, so deleting it doesn't remove it for good.
If an attacker logs in with these credentials, they get global super-admin rights. That bypasses per-record authorization and tenant scoping.
VulnCheck disclosed the issue. NVD published the record on 2026-10-12, and its status is currently "Received."
Why It Matters
- CVSS 3.1: 9.8 (CRITICAL). Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0: 9.3 (CRITICAL)
The attack works over the network, has low complexity, and needs no privileges or user interaction. Confidentiality, integrity and availability impacts are all rated High. The account is a super admin that bypasses tenant scoping, so in multi-tenant deployments one login could expose every tenant's data. Because rpd:make re-creates the account, a cleanup done once may not hold.
Exploitation status: This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources don't confirm any active exploitation.
What's Vulnerable
| Vendor | Product | Package | Affected | Fixed |
|---|---|---|---|---|
| zofe | rapyd-admin | pkg:composer/zofe/rapyd-admin |
9.0.0 through versions before 9.20.0 | 9.20.0 |
The NVD record lists no CPE entries yet.
Patch Status
Version 9.20.0 fixes the issue, and the fix commit is referenced below. There is no CISA KEV entry, so CISA has set no required action or due date.
Recommended action:
- Upgrade zofe/rapyd-admin to 9.20.0 or later.