CVE-2025-57766 Fides's Admin UI User Password Change Does Not Invalidate Current Session

What is CVE-2025-57766?

CVE-2025-57766 is a low-severity vulnerability in ethyca fides, published on 8 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the issue. No known workarounds are available.

Weakness: CWE-613

Which versions are affected by CVE-2025-57766?

3 open source packages ship an affected version, including ethyca-fides. It affects 1 product.

Products include Ethyca Fides.

How do I fix CVE-2025-57766?

Upgrade ethyca-fides to 2.69.1 or later.

Is CVE-2025-57766 being exploited?

There is no known exploitation of CVE-2025-57766 in the wild and no public exploit code.

Other vulnerabilities in ethyca fides

• CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine Critical 9.1
• CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides High 8.8
• CVE-2025-57817 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation High 8.6
• CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides High 8.2
• CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rpw8-82v9-3q87, PYSEC-2026-1348.