Vulnerability in Ethyca Fides
CVE-2025-57766
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the issue. No known workarounds are available.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (21.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 21.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Ethyca Fides — versions < 2.69.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/ethyca/fides/security/advisories/GHSA-rpw8-82v9-3q87 (Exploit, Vendor Advisory)
- github.com/ethyca/fides/commit/8daec4f5ad3daf0f0bdab4814f6757eb0965104b (Patch)
- github.com/ethyca/fides/releases/tag/2.69.1 (Release Notes)
Frequently asked questions
- What is CVE-2025-57766?
- CVE-2025-57766 is a medium-severity vulnerability in Ethyca Fides, classified under Insufficient Session Expiration. CVSS score: 4.8/10. Published 2025-09-08.
- How severe is CVE-2025-57766?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2025-57766 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.