CVE-2025-57766

CVE-2025-57766 affects ethyca fides, an open-source privacy engineering platform, where versions prior to 2.69.1 fail to invalidate active user sessions after an admin UI password change. This creates a vulnerability chaining opportunity, allowing attackers who have already obtained session tokens (e.g., via XSS) to maintain access. The vulnerability has a CVSS score of 4.8 (Medium), indicating a network-based attack with high complexity and low impact on confidentiality and integrity, as it requires a prerequisite vulnerability for exploitation. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.