{"cve":"CVE-2025-57815","nvd":{"published":"2025-09-08T22:15:33.520","modified":"2026-06-17T09:43:29.310","status":"Analyzed","description":"Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or password spraying, which poses a risk to accounts with weak or previously compromised passwords. Version 2.69.1 fixes the issue. For organizations with commercial Fides Enterprise licenses, configuring Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) is an effective workaround. When OIDC SSO is enabled, username/password authentication can be disabled entirely, which eliminates this attack vector. This functionality is not available for Fides Open Source users.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","score":1.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5},"cwes":["CWE-307"],"references":["https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c","https://github.com/ethyca/fides/releases/tag/2.69.1","https://github.com/ethyca/fides/security/advisories/GHSA-7q62-r88r-j5gw"],"products":["ethyca:fides"],"source":"nvd","synced_at":"2026-10-19T22:08:41.295252406+00:00"},"epss":{"cve":"CVE-2025-57815","score":0.00295,"percentile":0.22155,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-7q62-r88r-j5gw","url":"https://osv.dev/vulnerability/GHSA-7q62-r88r-j5gw","summary":"Fides has a Lack of Brute-Force Protections on Authentication Endpoints","modified":"2026-09-10T03:50:27.979214286Z","packages":[{"ecosystem":"PyPI","name":"ethyca-fides","purl":"pkg:pypi/ethyca-fides","ranges":["<2.69.1"],"fixed":["2.69.1"]}]},{"id":"PYSEC-2026-1335","url":"https://osv.dev/vulnerability/PYSEC-2026-1335","summary":"Fides has a Lack of Brute-Force Protections on Authentication Endpoints","modified":"2026-07-07T17:46:35.172597472Z","packages":[{"ecosystem":"PyPI","name":"ethyca-fides","purl":"pkg:pypi/ethyca-fides","ranges":["<2.69.1"],"fixed":["2.69.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}