CVE-2025-57766
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-08

Last updated on: 2025-09-10

Assigner: GitHub, Inc.

Description
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the issue. No known workarounds are available.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-08
Last Modified
2025-09-10
Generated
2026-05-07
AI Q&A
2025-09-09
EPSS Evaluated
2026-05-05
NVD
CVE-2025-57766
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ethyca fides to 2.69.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in Fides occurs because when an admin user changes their password via the admin UI, active user sessions are not invalidated. This means that if an attacker has already obtained valid session tokens through other means (like cross-site scripting), they can continue to access the account even after the password has been reset. The vulnerability itself is not directly exploitable without first having a way to get valid session tokens. It was fixed in version 2.69.1.


How can this vulnerability impact me? :

The vulnerability can allow attackers who have obtained session tokens to maintain unauthorized access to user accounts even after the password has been changed. This could lead to continued unauthorized access and potential misuse of the affected accounts, undermining account security.


What immediate steps should I take to mitigate this vulnerability?

Upgrade Fides to version 2.69.1 or later, as this version fixes the vulnerability. Since no known workarounds are available, applying the update is the recommended immediate mitigation step.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart