CVE-2025-2746
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
Analysis
Kentico Xperience through 13.0.172 contains an authentication bypass in the Staging Sync Server through empty SHA1 username handling in digest authentication, allowing administrative object control.
Technical Context
The CWE-288 authentication bypass exploits the digest authentication implementation where an empty SHA1 hash for the username field matches a specific validation condition, allowing the attacker to authenticate without valid credentials.
Affected Products
['Kentico Xperience through 13.0.172']
Remediation
Update to Kentico Xperience 13.0.173+. Restrict access to the Staging Sync Server endpoint. Audit for unauthorized staging operations.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today