Rapyd Admin Hard-Coded Credentials Vulnerability

Rapyd Admin versions 9.0.0 before 9.20.0 contain a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access.

The flaw involves an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run.

• Affected versions: 9.0.0 before 9.20.0
• Attackers can log in as a global super admin
• Bypasses per-record authorization and tenant scoping