CVE-2025-57766 - CVE House

Back to Database

Status published Low CVE-2025-57766

Fides's Admin UI User Password Change Does Not Invalidate Current Session

1.7 CVSS

Vulnerability Description

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the issue. No known workarounds are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-57766

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ethyca

View All →

Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

Fides Lacks Brute-Force Protections on Authentication Endpoints

Password Policy Bypass Vulnerability in Fides Webserver

Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Affected Vendor

ethyca

View all reports →

Affected Software

fides

Vulnerable Versions:

< 2.69.1

Timeline

Official Publish: September 8th, 2025

Last Modified: September 9th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1539 Steal Web Session Cookie

Credential Access

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1021 Remote Services

Lateral Movement

T1562 Impair Defenses

Defense Evasion