Kentico Xperience up to 13.0.172 Empty SHA1 Username improper authentication

Summaryinfo

A vulnerability classified as critical has been found in Kentico Xperience up to 13.0.172. Affected by this issue is some unknown functionality of the component Empty SHA1 Username Handler. Performing a manipulation results in improper authentication. This vulnerability was named CVE-2025-2746. The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Kentico Xperience up to 13.0.172. This affects some unknown processing of the component Empty SHA1 Username Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.

The weakness was presented by Piotr Bazydlo. The advisory is shared at labs.watchtowr.com. This vulnerability is uniquely identified as CVE-2025-2746 since 03/24/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but an exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/20/2025).

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 10/20/2025 with a due date of 11/10/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-8008). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Kentico

Name

• Xperience

Version

• 13.0.172

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion