---
title: Security advisory 2025-11-13
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## Timing attack vulnerability in content sync authentication

**CVSS**: 8.3\
**Affected versions**: 22.0.0 - 30.11.3\
**Category**: Side-channel attack

### Summary

A potential vulnerability was identified in the authentication process for the [content synchronization](https://docs.kentico.com/documentation/business-users/content-sync.md) feature. The API key verification mechanism was not sufficiently resistant to side-channel attacks, which could theoretically allow an attacker to infer secret values through timing analysis.

Successful exploitation would be highly impractical, requiring an extensive number of requests over a high-latency public network. At this time, we have no indication that the vulnerability has been exploited in any real-world scenario.

This vulnerability was addressed by using a cryptographically secure comparison function, ensuring robust protection against timing and other side-channel attacks.

### How to fix

Update to the latest Xperience by Kentico version. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.