Vulnerability in Ethyca Fides
CVE-2025-57766
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained…
EPSS: 0.001 (22.0th percentile) — read the EPSS interpretation.
Affected products
- Ethyca Fides — versions < 2.69.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/ethyca/fides/security/advisories/GHSA-rpw8-82v9-3q87 (x_refsource_CONFIRM)
- https://github.com/ethyca/fides/commit/8daec4f5ad3daf0f0bdab4814f6757eb0965104b (x_refsource_MISC)
- https://github.com/ethyca/fides/releases/tag/2.69.1 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-57766?
- CVE-2025-57766 is a vulnerability in Ethyca Fides, classified under Insufficient Session Expiration. Published 2025-09-08.
- Is CVE-2025-57766 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.