Read the docs
TI-2025-35698 Aliases CVE-2025-57815GHSA-7q62-r88r-j5gw

Fides Lacks Brute-Force Protections on Authentication Endpoints

Priority LOW 9CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-307.

Summary

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or password spraying, which poses a risk to accounts with weak or previously compromised passwords. Version 2.69.1 fixes the issue. For organizations with commercial Fides Enterprise licenses, configuring Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) is an effective workaround. When OIDC SSO is enabled, username/password authentication can be disabled entirely, which eliminates this attack vector. This functionality is not available for Fides Open Source users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00295 22nd percentileScored 2026-11-07
Fix Fixed fides (ethyca): 2.69.1ethyca-fides (PyPI): 2.69.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ethycafidesbefore 2.69.12.69.1Patch availableCNA
—ethyca-fides (PyPI)before 2.69.12.69.1Patch availableGHSA-7q62-r88r-j5gw
  • fides Vendorethyca Affected before 2.69.1 Fixed in 2.69.1 Patch available CNA
  • ethyca-fides (PyPI) Vendor— Affected before 2.69.1 Fixed in 2.69.1 Patch available GHSA-7q62-r88r-j5gw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*before 2.69.1Vulnerableethyca
  • cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:* Versions before 2.69.1 Vulnerable ·ethyca

Remediation

  • Fix · CNA fides (ethyca) Fixed in 2.69.1
  • Fix · GHSA-7q62-r88r-j5gw ethyca-fides (PyPI) Fixed in 2.69.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-57815
  2. 2026-10-03 Alias added: GHSA-7q62-r88r-j5gw

References

Patch 1

Advisory 2

Other 2

  • TI-2024-30165 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine CVSS 3.1CRITICAL 9.1
  • TI-2024-30164 Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2024-20599 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL CVSS 3.1MEDIUM 5.3
  • TI-2024-23262 Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides CVSS 3.1MEDIUM 6.5
  • TI-2023-26088 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides CVSS 3.1CRITICAL 9.1
  • TI-2025-35700 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation CVSS 4.0HIGH 8.6
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences