Rapyd Admin CVE-2026-109566

Exploitation requires that the Rapyd Admin login interface is network-reachable and that the instance was initialized with the standard setup installer (rpd:make:setup / rpd:make), which seeds the admin@laravel account with the static password 'admin'. In affected versions (9.0.0 up to the fix) this account is silently re-created on every rpd:make run, so even an operator who changed or removed the password can have the default restored without notice - this is the key factor that makes the condition near-universal for seeded installs rather than a rare edge case. Exploitation is LIMITED only where the admin@laravel account was deleted or its password changed AND rpd:make has not been re-run since, or where the login endpoint is not exposed to the attacker's network. No user interaction, no prior authentication, and no non-default feature toggle is needed - the vulnerable seeding is the default installer behavior.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) is fully consistent with the root cause: a hard-coded, publicly documented credential pair (admin@laravel / admin, CWE-798) that grants global super-admin, bypassing per-record authorization and tenant scoping. The attack vector, low complexity, and no-privilege/no-interaction metrics all align with the description - there is no conflict between the vector and the narrative. No EPSS score was provided, so statistical exploitation likelihood cannot be quantified. The CVE is NOT in CISA KEV and no formal POC artifact is flagged, so per strict signal rules this is 'no public exploit identified at time of analysis'; however, the exploit is trivial by nature because the credentials themselves are disclosed verbatim in the vendor advisory and CHANGELOG, meaning weaponization requires zero development effort. The dominant mitigating factor is real-world prevalence: Rapyd Admin is a niche open-source Laravel admin package, so widespread opportunistic scanning is less likely than targeted exploitation of known deployments. Net assessment: critical technical impact and trivial exploitability, bounded mainly by limited deployment footprint and whether instances are network-reachable.

An attacker discovers a network-reachable Rapyd Admin (zofe/rapyd-admin) instance running a version between 9.0.0 and the fixed release and submits the published default credentials admin@laravel / admin to the login form, instantly obtaining global super-admin that bypasses tenant isolation and per-record authorization. No exploit tooling is required since the credentials are published in the vendor advisory and CHANGELOG. Because the account is silently re-seeded on every rpd:make run, even operators who previously changed or deleted the password may have had it reverted to the default.