CVE-2025-57815 Fides Lacks Brute-Force Protections on Authentication Endpoints
Attackers can perform brute-force credential stuffing on Fides login endpoints due to missing anti-automation controls, risking account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-57815?
CVE-2025-57815 is a low-severity authentication bypass vulnerability in ethyca fides, published on 8 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or password spraying, which poses a risk to accounts with weak or previously compromised passwords. Version 2.69.1 fixes the issue. For organizations with commercial Fides Enterprise licenses, configuring Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) is an effective workaround. When OIDC SSO is enabled, username/password authentication can be disabled entirely, which eliminates this attack vector. This functionality is not available for Fides Open Source users.
Weakness: CWE-307
Which versions are affected by CVE-2025-57815?
3 open source packages ship an affected version, including ethyca-fides. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ethyca-fides PyPI | All versions | 2.69.1 |
ethyca-fides PyPI | All versions | 2.69.1 |
ethyca-fides PyPI | All versions | 2.69.1 |
Products include Ethyca Fides.
How do I fix CVE-2025-57815?
Upgrade ethyca-fides to 2.69.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-57815 being exploited?
There is no known exploitation of CVE-2025-57815 in the wild and no public exploit code.
Other vulnerabilities in ethyca fides
- CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
- CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides
- CVE-2025-57817 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
- CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
- CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload
Sources
Also known as GHSA-7q62-r88r-j5gw, PYSEC-2026-1335.