Summary
generated automatically from NVD dataRapyd Admin versions from 9.0.0 before 9.20.0 contain a hard-coded credentials flaw (CWE-798). The setup installer seeds an admin@laravel account with the password admin via AuthSeeder, and it is silently re-created on every rpd:make run. A remote unauthenticated attacker can log in as a global super admin, bypassing per-record authorization and tenant scoping, and the flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.
NVD description
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
EPSS · FIRST.org
0.44%probability of exploitation in the next 30 days
Higher than 36% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 12 oct. 2026
- Updated
- 16 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (5)
Similar CVEs
Other vulnerabilities of type CWE-798
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.