AIKIDO-2026-10639
ethyca-fides is vulnerable to Authentication Bypass Using an Alternate Path or Channel
60
Medium Risk
This Affects:
ethyca-fidesTL;DR
Affected versions of this package skip the identity-verification check on privacy requests classified as duplicates, so administrators can approve them even when the requester was never verified. An unverified requester could trigger personal-data actions through a crafted duplicate request.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ethyca-fides is vulnerable to Authentication Bypass Using an Alternate Path or Channel in versions 2.75.0 - 2.83.1.
How to fix this
Upgrade the ethyca-fides library to the patch version.
Links
GitHub Release
Fix Commits
github.com/ethyca/fides/commit/0e320b20934eb5af3a3d5127dba2691605d7ff37github.com/ethyca/fides/commit/e7a6527b0f9fdc9887b86a89bb5453e7421882dd
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.