Hard-Coded Credentials Vulnerability in Rapyd Admin by Zofe

CVE-2026-109566

What is CVE-2026-109566?

Rapyd Admin versions from 9.0.0 to 9.19.0 are susceptible to a hard-coded credentials vulnerability, allowing remote attackers to gain super-admin access. This flaw is due to an account created by the AuthSeeder during installation, which uses default credentials that are replicated in every environment setup. Consequently, attackers can bypass authorization controls and tenant isolation, leading to a significant security risk. It's crucial for users to upgrade to version 9.20.0 or later to mitigate this vulnerability.

References