CVE-2026-109566 is a hard-coded credentials flaw (CWE-798) in Rapyd Admin from 9.0.0 before 9.20.0, scored 9.8 critical. A seeded admin account with a known password gives super admin access. Update to 9.20.0, then change the password of that account or delete it.
What's affected
Rapyd Admin from 9.0.0 before 9.20.0, per the CVE record. Release v9.20.0 is labeled a security release and was tagged on 28 September, according to the GitHub release page.
The release notes list five issues fixed together. Besides the known password on the seeded admin, they include an account takeover inside a tenant, a privilege escalation to the admin role, and two stored cross site scripting sinks. So updating covers more than this one CVE.
How to check if you're exposed
Check the installed version with Composer:
composer show | grep -i rapyd
Then look at your user table for the seeded account that the setup installer creates. The record says it is named after the default Laravel domain pattern and is silently re-created on each run of the rpd:make command. The release notes tell you to change its password or delete it after updating.
Also review user display names and rich text values that contain markup, since the release notes mention stored cross site scripting.
You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
What to do now
- Update Rapyd Admin to 9.20.0 or later.
- Change the password of the seeded admin account, or delete the account, as the release notes advise.
- Check whether anyone ran
rpd:makeon a live environment, since the record says it re-creates the account every time. - Review recent logins by super admin accounts and check for unexpected role changes.
- Search user names and rich text fields for markup that you did not put there.
Why it matters
Seed data exists to make a fresh install usable. When the seed creates a privileged account with a known password, every install that skipped the cleanup step is open to anyone who reads the project source. The class is CWE-798, use of hard-coded credentials.
The record adds that the account bypasses per record authorization and tenant scoping. A global super admin sees every tenant, so one forgotten seed account breaks the whole isolation model.
Seed accounts belong in development only. Make your deployment steps fail when a known account exists. The record does not flag this CVE as exploited in the wild and it is not a CISA Known Exploited Vulnerability.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is updating enough?
The release notes say to change the password of the seeded account or delete it after updating, so do both steps.
Does the account come back?
The record says setup silently re-creates it on every rpd:make run on affected versions. Check your update notes for the fixed behavior.
Sources
Last reviewed: 19 October 2026.
