CVE-2025-2746 Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel
Attackers can bypass authentication via empty SHA1 usernames in Staging Sync Server digest auth to control administrative objects.
- Exploited in the wild
- Since 20 Oct 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2746?
CVE-2025-2746 is a critical authentication bypass vulnerability in Kentico Xperience, published on 24 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
Weakness: CWE-288
Which versions are affected by CVE-2025-2746?
It affects 1 product.
Products include Kentico Xperience.
How do I fix CVE-2025-2746?
No fix has been published for CVE-2025-2746 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Nov 2025.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-2746 being exploited?
Yes. Attackers have exploited CVE-2025-2746 in the wild since at least 20 Oct 2025.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Kentico Xperience
Sources
Also known as GHSA-h4vh-mhxh-6rrr.