Rapyd Admin: Hard-coded super-admin credentials via AuthSeeder

Summary

Rapyd Admin, an open-source admin panel for Laravel, creates the account admin@laravel with the fixed password admin during setup. The account is re-created on every rpd:make run. A remote, unauthenticated attacker who can reach the admin panel can log in as a global super admin, bypassing per-record authorization and tenant scoping.

Affected

• zofe Rapyd Admin 9.0.0 to before 9.20.0
• Versions before 9.0.0: Unknown.

Fixed in

• Upgrade to Rapyd Admin 9.20.0 or later. The fix generates a random admin password during setup, shown once.

Workaround

• No vendor workaround documented.
• Changing or deleting admin@laravel is not sufficient on affected versions, because the seeder re-creates it on every rpd:make run.
• Recommendation of IT Services Schneeberger (not from the vendor): restrict access to the admin panel to a VPN or an allow-list until the upgrade is done.

Exploitation

• No evidence of exploitation in the wild found. One aggregator states the CVE is not marked as known exploited.
• No public proof of concept found.
• CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
• The default login is listed in the project's installation instructions according to research notes, so it may be widely known.

Our recommendation

• Identify all Rapyd Admin installations (check composer.lock) and whether each admin panel is reachable from the internet.
• Upgrade to 9.20.0 or later.
• Change or delete admin@laravel on every installation and confirm that no other default accounts exist.
• Check the logs for logins with this account.
• Restrict the admin panel to a VPN or allow-list where possible.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  hyderpwn/CVE-rapyd-admin

Research sources

• Rapyd Admin release 9.20.0 github.com
• VulnCheck advisory www.vulncheck.com
• AuthSeeder.php at v9.19.0 github.com
• Rapyd Admin GitHub repository github.com
• OSV CVE-2026-109566 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:24.