CVE-2025-2746

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2746
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://devnet.kentico.com/download/hotfixes Patch
https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 Third Party Advisory
https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ Exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746
Configurations

Configuration 1 (hide)

cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*
History

21 Oct 2025, 23:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2746 -

16 Oct 2025, 20:07

Type Values Removed Values Added
First Time Kentico xperience
Kentico
CPE cpe:2.3:a:kentico:xperience:*:*:*:*:*:*:*:*
References () https://devnet.kentico.com/download/hotfixes - () https://devnet.kentico.com/download/hotfixes - Patch
References () https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 - () https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 - Third Party Advisory
References () https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ - () https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ - Exploit, Third Party Advisory

23 Sep 2025, 16:15

Type Values Removed Values Added
CWE CWE-287 CWE-288

27 Mar 2025, 16:45

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de omisión de autenticación en Kentico Xperience permite omitir la autenticación mediante la gestión de contraseñas del servidor de sincronización de pruebas de nombres de usuario SHA1 vacíos en la autenticación implícita. Esta omisión de autenticación permite a un atacante controlar objetos administrativos. Este problema afecta a Xperience hasta la versión 13.0.172.

24 Mar 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-24 19:15

Updated : 2025-10-21 23:16

NVD link : CVE-2025-2746

Mitre link : CVE-2025-2746

CVE.ORG link : CVE-2025-2746

JSON object : View

Products Affected

kentico

  • xperience
CWE
CWE-288

Authentication Bypass Using an Alternate Path or Channel