# CVE-2026-109566: Rapyd Admin hard-coded credentials in AuthSeeder

Source: https://junglewise.ai/threats/cve-2026-109566-rapyd-admin-from-9-0-0-before-9-20-0-contains-a-hard-coded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109566 · Severity: critical · CVSS 9.8 · Published 2026-10-12

Rapyd Admin is an open-source admin panel for Laravel applications. Versions 9.0.0 through 9.19.x contain hard-coded credentials that allow remote attackers to log in as a super-admin without authentication. The default credentials (admin@laravel / admin) are created during initial setup and automatically recreated when database seeding runs, enabling account takeover and complete system compromise.

Technologies: [Zofe Rapyd Admin](https://junglewise.ai/threats/technologies/rapyd-admin). Vendors: [Zofe](https://junglewise.ai/threats/vendors/zofe).

## Quick answers

**Is CVE-2026-109566 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109566 being exploited in the wild.

**How severe is CVE-2026-109566?** Critical severity, with a CVSS score of 9.8, published 12 October 2026.

**Which products and versions are affected?** Zofe Rapyd Admin 9.0.0 to 9.19.x.

**Is there a fix for CVE-2026-109566?** Yes: fixed in 9.20.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109566 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109566?** Check whether you run Zofe Rapyd Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.20.0

## Technical details

The AuthSeeder class in Rapyd Admin uses firstOrCreate() to establish a super-admin account with a hard-coded email (admin@laravel) and password hash for 'admin', without option to disable this behavior. An unauthenticated network attacker with access to the admin panel can authenticate using these credentials and gain global super-admin privileges, bypassing all per-record authorization and tenant isolation controls. The vulnerability affects all versions from 9.0.0 to 9.19.x; version 9.20.0 and later contain the fix.

## Affected products

- Zofe Rapyd Admin 9.0.0 to 9.19.x

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/zofe/rapyd-admin](https://github.com/zofe/rapyd-admin)
- [https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/Modules/Auth/Database/Seeders/AuthSeeder.php](https://github.com/zofe/rapyd-admin/blob/v9.19.0/src/Modules/Auth/Database/Seeders/AuthSeeder.php)

## Related threats

- [Rapyd Admin stored cross-site scripting in rich-text component](https://junglewise.ai/threats/cve-2026-110239-rapyd-admin-before-9-20-0-contains-a-stored-cross-site-scripting)
- [Rapyd Admin authorization bypass in UsersModalEditEmbed](https://junglewise.ai/threats/cve-2026-110238-rapyd-admin-from-9-0-0-before-9-20-0-contains-an-authorization)
- [Rapyd Admin stored cross-site scripting in display names](https://junglewise.ai/threats/cve-2026-109565-rapyd-admin-from-9-4-0-before-9-20-0-contains-a-stored-cross)