Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass

Kentico Xperience has a critical flaw in its Staging Sync Server that allows attackers to bypass password authentication by exploiting how it handles empty usernames in digest authentication. This lets attackers gain administrative access without knowing the correct password.

The vulnerability exists in the digest authentication mechanism of Kentico Xperience's Staging Sync Server, where improper handling of empty SHA1 usernames allows authentication bypass. An attacker can craft a malicious digest authentication request to gain unauthorized administrative access to control sensitive objects, affecting versions through 13.0.172.