CVE-2026-109566 in Rapyd Admin
Summary
by MITRE • 10/13/2026
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Rapyd Admin versions prior to 9.20.0 represents a critical failure in secure configuration management, specifically categorized under CWE-798: Use of Hard-coded Credentials. This flaw stems from the inclusion of default administrative credentials within the application's source code or database seeding scripts rather than requiring dynamic generation during installation. The specific mechanism involves an AuthSeeder component that initializes a super-admin account with the username admin@laravel and the password admin upon execution of the setup installer. Crucially, this credential set is not only present in fresh installations but is also silently re-created every time the rpd:make command is executed. This persistent regeneration ensures that even if an administrator attempts to change or remove these default credentials, they will be overwritten during routine maintenance or deployment operations involving the make command, effectively locking out legitimate security hardening efforts and leaving a backdoor permanently active in the application environment.
From an operational perspective, this vulnerability allows remote unauthenticated attackers to gain immediate super-admin access without any form of authentication bypass techniques such as SQL injection or logic flaws. The attacker simply needs to know the static credentials, which are often discoverable through source code review, default configuration documentation, or common knowledge of development defaults. Once authenticated, the attacker assumes the role of a global super administrator, thereby completely bypassing per-record authorization controls and tenant scoping mechanisms that are designed to isolate data between different users or organizations in multi-tenant architectures. This level of access grants full control over the application's database, configuration files, and potentially connected systems, leading to total compromise of confidentiality, integrity, and availability for all tenants hosted within the Rapyd Admin instance.
The impact extends beyond simple unauthorized login; it facilitates a complete breach of data isolation principles inherent in multi-tenant SaaS applications. An attacker can exfiltrate sensitive customer data from any tenant, modify critical system configurations to install persistent malware or web shells, and escalate privileges further if integrated services are present. This aligns with the MITRE ATT&CK technique T1078: Valid Accounts, where adversaries leverage legitimate credentials to maintain access without triggering typical intrusion detection alerts associated with brute-force attacks. The silent re-creation of these accounts via the rpd:make command makes remediation difficult for administrators who may not be aware that their security efforts are being systematically undone by standard development or deployment workflows.
Mitigation strategies must address both the immediate presence of the credentials and the underlying architectural flaw. Organizations running affected versions should immediately update to Rapyd Admin version 9.20.0 or later, where this hard-coded credential issue has been resolved. For environments that cannot be updated immediately due to dependency constraints, administrators should manually delete the admin@laravel account from the database after every execution of the rpd:make command and ensure no default credentials are present in any seeded data files. Furthermore, it is imperative to enforce strong password policies for all administrative accounts and implement multi-factor authentication where supported by the framework. Long-term remediation requires a shift in development practices to eliminate hard-coded secrets entirely, utilizing environment-specific configuration management or secure key vaults to generate unique, complex credentials during the initial setup process that are not overwritten by subsequent build or make commands.