CVE-2025-57766: ethyca-fides Admin UI Session Persistence Vulnerability
Summary
CVE-2025-57766: Fides' Admin UI User Password Change Does Not Invalidate Current Session. Affects ethyca-fides versions < 2.69.1. Fixed in 2.69.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ethyca Fides is an open-source privacy management platform that helps organizations manage data privacy compliance. It provides tools for data discovery, consent management, and privacy assessments. However, it has a vulnerability where changing a user's password does not invalidate active sessions, potentially allowing unauthorized access if session tokens are compromised.
Vulnerability Detail
The vulnerability arises from the Admin UI's failure to invalidate active user sessions when a password is changed. This means that if an attacker has obtained a valid session token through methods like Cross-Site Scripting (XSS) or session hijacking, they can maintain access even after the password is reset. The authentication system relies on the cryptographic integrity of tokens and their expiration time, rather than the current password state, which creates a security loophole.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.69.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.69.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for this vulnerability. The only solution is to update to the patched version.
Conclusion
The ethyca-fides Admin UI vulnerability (CVE-2025-57766) poses a risk by allowing session persistence after password changes, which can be exploited if session tokens are compromised. Users are strongly advised to upgrade to the patched version to mitigate this risk.
See every vulnerability recorded for ethyca-fides →
FAQ
The vulnerability allows active sessions to remain valid even after a password change, which can be exploited if session tokens are compromised.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
The main impact is that attackers can maintain access to user accounts beyond the intended remediation window, defeating common incident response measures.
Yes, the vulnerability has been patched in Fides version 2.69.1. Users should upgrade to this version or later.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
