CVE-2025-57815: ethyca-fides - Lack of Brute-Force Protections on Authentication Endpoints
Summary
CVE-2025-57815: Fides has a Lack of Brute-Force Protections on Authentication Endpoints. Affects ethyca-fides versions < 2.69.1. Fixed in 2.69.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ethyca Fides is an open-source privacy management platform designed to help organizations manage their data privacy compliance. It provides tools for data discovery, consent management, and privacy impact assessments. However, the platform has a vulnerability that exposes its login endpoint to brute-force attacks due to insufficient anti-automation controls.
Vulnerability Detail
The vulnerability arises from the reliance on a general IP-based rate limit for all API traffic, which does not specifically protect the login endpoint from brute-force attacks. This lack of tailored protections allows attackers to conduct credential testing attacks, such as credential stuffing or password spraying, especially against accounts with weak or previously compromised passwords. Although existing global rate limits and password complexity requirements provide some baseline protection, they are insufficient against targeted attacks.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.69.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.69.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For organizations with commercial Fides Enterprise licenses, enabling Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) is an effective workaround. This configuration allows you to disable username/password authentication entirely, thereby eliminating this attack vector.
Conclusion
The ethyca-fides package has a vulnerability (CVE-2025-57815) that exposes its authentication endpoints to brute-force attacks. Users are encouraged to upgrade to the patched version 2.69.1 to enhance security. Additionally, organizations can implement workarounds such as enabling SSO to mitigate risks.
See every vulnerability recorded for ethyca-fides →
FAQ
CVE-2025-57815 is a vulnerability in the ethyca-fides package that allows for brute-force attacks on the authentication endpoints due to a lack of specific anti-automation controls.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring signup.
The risks include potential unauthorized access to user accounts, especially if weak or compromised passwords are used, which could lead to data breaches.
Yes, the vulnerability has been patched in Fides version 2.69.1. Users are advised to upgrade to this version or later.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just the Pipfile.lock. It helps developers maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
