CVE-2025-2746
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 59.05%
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-288
- Published
- 2025-03-24
- Last modified
- 2026-02-26
Affected products
- Kentico Xperience
Weakness type
Related vulnerabilities
- CVE-2026-86084 — n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
- CVE-2026-83527 — An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a...
- CVE-2026-62650 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side...
- CVE-2026-76169 — fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
- CVE-2026-62916 — Microsoft Entra ID Elevation of Privilege Vulnerability
- CVE-2026-84777 — WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability
- CVE-2026-16647 — Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
- CVE-2026-81168 — CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105