CVE-2026-109566

Summary

A hard-coded admin account with password 'admin' exists in Rapyd Admin versions 9.0.0 through 9.19.0, allowing remote attackers to gain super-admin access without authentication. This vulnerability bypasses all per-record authorization and tenant scoping mechanisms.

Exploitability

Exploitation is extremely easy with no prerequisites - attackers simply need to access the login endpoint and use the hardcoded credentials admin@laravel/admin to gain full administrative control.

Blast radius

The impact is severe as attackers can gain global super-admin access across all tenants and records, potentially leading to complete system compromise, data exfiltration, and privilege escalation across the entire application.

Detection

Monitor authentication logs for failed login attempts with username 'admin@laravel' and password 'admin', particularly when these occur from external IP addresses, as well as any successful logins using this hardcoded account.

Prioritized remediation

Upgrade to Rapyd Admin 9.20.0 or later to fix the hard-coded credentials vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.