CVE-2025-2746
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
- Record
CVE-2025-2746- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2025-8008
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
- Record
EUVD-2025-8008- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h4vh-mhxh-6rrr
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the...
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
- Record
GHSA-h4vh-mhxh-6rrr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287, CWE-288
- Updated
- 2026-11-02
CISA KEV No score
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
- Record
CVE-2025-2746- Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
- Record
CVE-2025-2746- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011) |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-2746 is a critical vulnerability (CVSS 9.8) in Kentico Xperience, published March 24, 2025. CISA lists it as known to be exploited, since October 20, 2025. EUVD reports exploitation since October 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 74.1%, the 99th percentile. No source names a fixed version.
References
labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms
devnet.kentico.com/download/hotfixes
github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011
vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746
nvd.nist.gov/vuln/detail/CVE-2025-2746