CVE-2025-2747
Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass
- State
- Published
- Severity
- 9.8 Critical
- Published
- Mar 24, 2025
- Updated
- Feb 26, 2026
- Reserved
- Mar 24, 2025
Description
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected Products
| Product | Versions |
|---|---|
XperienceKentico |
|
References
- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-auth-rce-chain-s-in-kentico-xperience-cms/technical-descriptionexploit
- https://devnet.kentico.com/download/hotfixesvendor-advisorypatch
- https://github.com/watchtowrlabs/kentico-xperience13-AuthBypass-wt-2025-0011exploit
- https://www.vulncheck.com/advisories/kentico-xperience-staging-sync-server-none-password-type-authentication-bypassthird-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2747government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.