{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/rapyd/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rapyd:rapyd_admin:9.0.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-109566"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rapyd Admin (9.0.0 - 9.19.x)","Rapyd Admin (9.0.0-9.19.9)"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","web-application","rapyd","cve-2026-109567"],"_cs_type":"advisory","_cs_vendors":["Rapyd"],"content_html":"\u003cp\u003eRapyd Admin versions 9.0.0 through 9.19.x contain a critical hard-coded credential vulnerability (CVE-2026-109566). During the initial setup of the application, the \u003ccode\u003eAuthSeeder\u003c/code\u003e component automatically generates a default administrative account with the email 'admin@laravel' and the password 'admin'. This behavior is persistent, as the account is silently re-created or reset whenever the \u003ccode\u003erpd:make\u003c/code\u003e command is executed on the server. Because this default account grants global super-admin privileges, remote unauthenticated attackers can use these credentials to gain full administrative control over the application. Successful exploitation results in complete bypass of tenant scoping and per-record authorization controls, potentially leading to unauthorized data access and total system compromise. This issue affects all deployments using the specified vulnerable versions, necessitating an immediate upgrade to version 9.20.0 or later.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS 3.1 base score of 9.8, reflecting its high impact and ease of exploitability. Successful attacks result in full administrative access to the Rapyd Admin platform. This allows attackers to bypass organizational multi-tenancy and authorization boundaries, leading to full data exfiltration, administrative configuration changes, and potential further compromise of the underlying infrastructure. The number of impacted organizations is significant due to the prevalence of Rapyd Admin in web application deployments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Rapyd Admin to version 9.20.0 or later immediately to remove the \u003ccode\u003eAuthSeeder\u003c/code\u003e logic that generates the hard-coded credentials.\u003c/li\u003e\n\u003cli\u003eAudit all administrative logs for successful logins using the 'admin@laravel' email address.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the \u003ccode\u003erpd:make\u003c/code\u003e command execution and ensure that the administrative interface is not exposed to the public internet.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:42:45Z","date_published":"2026-10-12T22:39:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rapyd-admin-hardcoded-creds/","summary":"Rapyd Admin versions 9.0.0 through 9.19.x contain a hard-coded credential vulnerability that allows remote unauthenticated attackers to gain global super-admin access.","title":"Hard-Coded Credentials Vulnerability in Rapyd Admin","url":"https://feed.craftedsignal.io/briefs/2026-10-rapyd-admin-hardcoded-creds/"}],"language":"en","title":"CraftedSignal Threat Feed - Rapyd","version":"https://jsonfeed.org/version/1.1"}