CVE-2025-57766: Ethyca Fides Auth Bypass Vulnerability

CVE-2025-57766 Overview

CVE-2025-57766 is a session management weakness in Ethyca Fides, an open-source privacy engineering platform. Prior to version 2.69.1, admin UI password changes do not invalidate existing active sessions. An attacker who has already obtained a valid session token through a separate vector, such as cross-site scripting (XSS), can retain access to the account even after the victim resets their password. The flaw maps to CWE-613: Insufficient Session Expiration and is not directly exploitable on its own. Version 2.69.1 fixes the issue and no workarounds are available.

Critical Impact
Password reset does not terminate active sessions, allowing chained persistence after token theft in Fides deployments before 2.69.1.

Affected Products

Ethyca Fides versions prior to 2.69.1
Fides admin UI password change and reset flows
Deployments exposing the Fides admin UI to untrusted networks

Discovery Timeline

2025-09-08 - CVE-2025-57766 published to the National Vulnerability Database (NVD)
2025-09-08 - Ethyca publishes GitHub Security Advisory GHSA-rpw8-82v9-3q87 and releases Fides 2.69.1
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-57766

Vulnerability Analysis

The vulnerability resides in the Fides admin UI user management flow. When an administrator forces a password reset or a user updates their own password, the backend does not invalidate previously issued session tokens tied to the affected account. Any bearer of a stolen token continues to hold authenticated access until that token expires on its own schedule.

This behavior breaks a core assumption of password rotation as a compromise recovery control. Operators who reset a password in response to a suspected breach may believe they have evicted the attacker, while the attacker keeps a valid session cookie. The chained exploitation pattern typically pairs this issue with a token theft primitive such as reflected or stored XSS in the admin UI, session sniffing on unencrypted channels, or client-side malware.

Root Cause

The password change handlers in NewPasswordModal.tsx and UpdatePasswordModal.tsx did not call any session invalidation or logout logic after a successful password mutation. Server-side session records tied to prior credentials were left intact.

Attack Vector

Exploitation requires a prerequisite vulnerability. The attacker first obtains a valid session token, for example through XSS against an authenticated admin. The victim, or an administrator responding to alerts, then resets the compromised account's password. Because sessions are not invalidated, the attacker's captured token continues to authenticate requests to the Fides API and admin UI.

tsx

// Patch: clients/admin-ui/src/features/user-management/UpdatePasswordModal.tsx
 import { useDisclosure, useToast } from "fidesui";
+import { useRouter } from "next/router";
 import React, { useState } from "react";
+import { useDispatch } from "react-redux";

 import { successToastParams } from "../common/toast";
+import { clearAuthAndLogout } from "./logout-helpers";
 import { useUpdateUserPasswordMutation } from "./user-management.slice";

Source: ethyca/fides commit 8daec4f. The fix wires a clearAuthAndLogout helper into both the forced reset (NewPasswordModal.tsx) and self-service update (UpdatePasswordModal.tsx) flows so authentication state is cleared after a password mutation.

Detection Methods for CVE-2025-57766

Indicators of Compromise

Fides admin API requests authenticated with a session token issued before a recent password change timestamp on the same user account.
Concurrent admin UI activity from geographically or network-inconsistent client addresses tied to a single user identity.
Unexpected POST requests to Fides privacy configuration or user management endpoints shortly after a password reset event.

Detection Strategies

Correlate Fides audit logs for password change events with subsequent authenticated actions to identify sessions that should have been terminated.
Instrument the reverse proxy fronting Fides to log session identifiers and flag reuse of a token across disparate source IPs or user agents.
Alert on privileged actions in Fides performed by accounts within a defined window after a forced reset.

Monitoring Recommendations

Ingest Fides application logs and web server access logs into a centralized analytics platform for correlation across authentication and authorization events.
Baseline normal admin UI session durations and alert on sessions that persist across password reset boundaries.
Monitor for XSS indicators in the Fides admin UI, since token theft is the prerequisite for exploiting this weakness.

How to Mitigate CVE-2025-57766

Immediate Actions Required

Upgrade Fides to version 2.69.1 or later, which invalidates sessions on password change.
Force logout of all admin users after upgrade to clear any long-lived sessions issued under the vulnerable code path.
Rotate credentials for any account suspected of token exposure and audit recent admin activity.

Patch Information

Ethyca fixed the issue in Fides 2.69.1. Details are published in GitHub Security Advisory GHSA-rpw8-82v9-3q87 and the corresponding release notes for 2.69.1. The code fix is implemented in commit 8daec4f5ad3daf0f0bdab4814f6757eb0965104b.

Workarounds

No vendor-supplied workaround is available. Upgrading to 2.69.1 is the required remediation.
Restrict admin UI exposure to trusted networks or a VPN to reduce opportunity for token theft.
Shorten session lifetime and idle timeout at the identity or reverse proxy layer to limit the window of unauthorized reuse.

bash

# Upgrade Fides to the patched version
pip install --upgrade 'ethyca-fides>=2.69.1'

# Verify installed version
fides --version