Description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kentico | Xperience | ≤ 13.0.172 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011) http/cves/2025/CVE-2025-2746.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/ technical-description exploit
- https://devnet.kentico.com/download/hotfixes vendor-advisory patch
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011 exploit
- https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass third-party-advisory