Hard-Coded Credentials Vulnerability in Rapyd Admin

Rapyd Admin versions 9.0.0 through 9.19.x contain a critical hard-coded credential vulnerability (CVE-2026-109566). During the initial setup of the application, the AuthSeeder component automatically generates a default administrative account with the email 'admin@laravel' and the password 'admin'. This behavior is persistent, as the account is silently re-created or reset whenever the rpd:make command is executed on the server. Because this default account grants global super-admin privileges, remote unauthenticated attackers can use these credentials to gain full administrative control over the application. Successful exploitation results in complete bypass of tenant scoping and per-record authorization controls, potentially leading to unauthorized data access and total system compromise. This issue affects all deployments using the specified vulnerable versions, necessitating an immediate upgrade to version 9.20.0 or later.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.8, reflecting its high impact and ease of exploitability. Successful attacks result in full administrative access to the Rapyd Admin platform. This allows attackers to bypass organizational multi-tenancy and authorization boundaries, leading to full data exfiltration, administrative configuration changes, and potential further compromise of the underlying infrastructure. The number of impacted organizations is significant due to the prevalence of Rapyd Admin in web application deployments.

Recommendation

• Upgrade Rapyd Admin to version 9.20.0 or later immediately to remove the AuthSeeder logic that generates the hard-coded credentials.
• Audit all administrative logs for successful logins using the 'admin@laravel' email address.
• If immediate patching is not possible, disable the rpd:make command execution and ensure that the administrative interface is not exposed to the public internet.