Vulnerability · Published Sep 8, 2025 · Assigned by GitHub_M

CVE-2025-57766Fides's Admin UI User Password Change Does Not Invalidate Current Session

Low 1.7

In plain English

A low-severity security flaw in fides from ethyca. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)1.7Low

Exploit odds (30 days)0.3%top 77.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the issue. No known workarounds are available.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	ethyca-fides	2.69.1	GHSA-rpw8-82v9-3q87
PyPI	ethyca-fides	2.69.1	PYSEC-2026-1348

Affected products (as reported)

Vendor	Product	Versions
ethyca	fides	< 2.69.1

Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

References

https://github.com/ethyca/fides/security/advisories/GHSA-rpw8-82v9-3q87 x_refsource_CONFIRM
https://github.com/ethyca/fides/commit/8daec4f5ad3daf0f0bdab4814f6757eb0965104b x_refsource_MISC
https://github.com/ethyca/fides/releases/tag/2.69.1 x_refsource_MISC