Skip to content
Log inStart free trial

CVE-2025-2747

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server…

Critical Known exploited
Severity
9.8 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
97.17%
Chance of exploitation in the next 30 days. Higher than 99.89% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Oct 20, 2025
Weakness
CWE-288 Authentication Bypass Using an Alternate Path or Channel
Fix
None yet
No fixed version published
Exploited in the wild. Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability (Kentico Xperience CMS). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Nov 10, 2025.

Description

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-288: Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How to prevent it
  • Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

References

Advisories

Fixes and patches

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-vc32-4gwf-77xp
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
High Same weakness, CWE-288
GHSA-hxcx-9h4f-42xx
Snipe-IT: 2FA bypass via the API token flow
High Same weakness, CWE-288
GHSA-pf83-w3f9-8m37
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
Medium Same weakness, CWE-288
GHSA-p68q-wchp-6fh7
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
High Same weakness, CWE-288
CVE-2026-19490
Vulnerability in NetScaler ADC and NetScaler Gateway.
Critical Known exploited Same weakness, CWE-288
GHSA-7j72-f6wg-cxw6
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
Critical Same weakness, CWE-288
CVE-2026-18577
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
High Known exploited Same weakness, CWE-288
CVE-2026-18556
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
High Known exploited Same weakness, CWE-288
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor