CVE-2025-57815: Fides has a Lack of Brute-Force Protections on Authentication Endpoints

September 8, 2025 (updated September 13, 2025)

The Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or password spraying, which poses a risk to accounts with weak or previously compromised passwords.

References

github.com/advisories/GHSA-7q62-r88r-j5gw
github.com/ethyca/fides
github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c
github.com/ethyca/fides/releases/tag/2.69.1
github.com/ethyca/fides/security/advisories/GHSA-7q62-r88r-j5gw
nvd.nist.gov/vuln/detail/CVE-2025-57815

Code Behaviors & Features

Detect and mitigate CVE-2025-57815 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →