External risk intelligence

Rapyd Admin Hard-Coded Super-Admin Credentials Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109566

Rapyd Admin is a web-based administration interface for Laravel applications. Such administrative panels are commonly deployed as web applications intended for management access, and because this vulnerability allows unauthenticated access to the super-admin account, it represents a common exposure point for web-facing management services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Rapyd Admin software, affecting versions prior to 9.20.0. This issue involves hard-coded credentials that could allow unauthorized remote access to super-admin privileges. The primary concern is to confirm if this specific software is in use and if it is exposed to potential threats.

Hard-coded credentials grant unauthorized super-admin access.
Confirms if this widely used admin tool is affected.
Verify software usage and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the Rapyd Admin interface over the network. Since no authentication is required, they can use the default hard-coded credentials, `admin@laravel` with the password `admin`, to gain super-admin privileges. This allows them to bypass authorization and tenant restrictions, effectively compromising the entire application.

Entry Condition: Network access to the Rapyd Admin interface.
Trigger Point: Logging in with hard-coded default credentials.
Resulting Risk: Full super-admin access, bypassing all controls.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the hard-coded super-admin credentials could allow unauthenticated remote attackers to bypass authorization controls and access global administrative functions.

Super-admin access to the application.
Exploitation via default credentials.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Rapyd Admin interface, specifically impacting application owners and potentially infrastructure or platform teams responsible for its deployment. The first practical step is to locate all instances of Rapyd Admin, determine their exposure and business criticality, and identify the accountable teams for remediation.

Application owners should own the issue.
Verify exposed Rapyd Admin instances.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Rapyd Admin?

Rapyd Admin is a web-based interface built for Laravel applications. Developers integrate it into their projects to simplify administrative tasks and data management. It acts as a dashboard layer, enabling users to interact with database records and application settings through a browser.

What does CWE-798 mean for CVE-2026-109566?

CWE-798 is a weakness class for hard-coded credentials. In this specific vulnerability, the software includes a default 'admin@laravel' account with a fixed 'admin' password. This account is automatically generated by the installer and remains active, effectively embedding a permanent backdoor into the system that ignores security checks.

How is this vulnerability triggered?

An attacker triggers this by navigating to the Rapyd Admin interface over a network and entering the hard-coded credentials. The bug is not triggered by specific user actions or complex payloads; it simply requires the application to have the vulnerable AuthSeeder present, allowing instant login without needing any prior user account or valid session.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies that because Rapyd Admin is a web-based management interface, it is often deployed in ways that are accessible over a network. If your specific implementation is reachable by unauthorized parties via the internet or an untrusted network, it is considered highly exposed to this unauthenticated super-admin access.

What should I do if I use Rapyd Admin?

Your first step is to identify where Rapyd Admin is deployed in your environment and who is responsible for maintaining those instances. Verify your current version; if you are running anything earlier than 9.20.0, prioritize coordinating with your application team to update the software, as this version removes the vulnerable seeding mechanism.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.