CVE-2025-57815

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or password spraying, which poses a risk to accounts with weak or previously compromised passwords. Version 2.69.1 fixes the issue. For organizations with commercial Fides Enterprise licenses, configuring Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) is an effective workaround. When OIDC SSO is enabled, username/password authentication can be disabled entirely, which eliminates this attack vector. This functionality is not available for Fides Open Source users.

• CWE-307

• https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5cPatch
• https://github.com/ethyca/fides/releases/tag/2.69.1Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-7q62-r88r-j5gwVendor Advisory

Published

Sep 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5781Information Exposure Vulnerability in Hitachi Ops Center API…5.2
• CVE-2025-57810jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2025-57811Craft is a platform for creating digital experiences. From v…7.2
• CVE-2025-57812CUPS is a standards-based, open-source printing system, and …3.7
• CVE-2025-57813traQ is a messenger application built for Digital Creators C…5.9
• CVE-2025-57814request-filtering-agent is an http(s).Agent implementation t…5.5
• CVE-2025-57816Fides is an open-source privacy engineering platform. Prior …7.5
• CVE-2025-57817Fides is an open-source privacy engineering platform. Prior …7.2
• CVE-2025-57818Firecrawl turns entire websites into LLM-ready markdown or s…6.3
• CVE-2025-57819FreePBX is an open-source web-based graphical user interface…9.8
• CVE-2025-5782A vulnerability, which was classified as critical, has been …6.3
• CVE-2025-57820Svelte devalue is a utility library. Prior to version 5.3.2,…7.9