CVE-2025-57766: ethyca-fides Admin UI Password Change Vulnerability Allows Session Persistence
Summary
CVE-2025-57766: Fides' Admin UI User Password Change Does Not Invalidate Current Session. Affects ethyca-fides versions < 2.69.1. Fixed in 2.69.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ethyca Fides is an open-source privacy management platform designed to help organizations manage their data privacy compliance. It provides tools for data discovery, consent management, and policy enforcement. However, it has a vulnerability that affects its Admin UI, specifically regarding user password changes and session management.
Vulnerability Detail
The vulnerability arises from the fact that when a user changes their password through the Fides Admin UI, the system does not invalidate existing user sessions. This creates a potential security risk, as attackers who have previously obtained valid session tokens through other vulnerabilities (like XSS) can maintain access even after a password reset. The authentication tokens used by Fides are encrypted and have extended expiration periods, which means that unless the sessions are explicitly invalidated, they remain active. This issue is not directly exploitable on its own and requires prior vulnerabilities to obtain session tokens.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.69.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.69.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for this vulnerability. The only effective solution is to upgrade to the patched version.
Conclusion
The ethyca-fides package has a vulnerability that allows active user sessions to persist after a password change, which can be exploited if combined with other vulnerabilities. Users are strongly advised to upgrade to version 2.69.1 or later to secure their systems.
See every vulnerability recorded for ethyca-fides →
FAQ
CVE-2025-57766 is a vulnerability in the ethyca-fides package that allows active user sessions to persist even after a password change, posing a security risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While there are no workarounds, it is crucial to prioritize upgrading to the patched version as soon as possible to mitigate the risk.
The vulnerability can allow attackers to maintain access to user accounts even after a password change, extending the impact of client-side attacks and defeating incident response procedures.
The vulnerability has a CVSS score of 4.8, which is considered low severity, but it can still pose significant risks when combined with other vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
