CVE-2025-61733

HIGH

Apache Kylin 4.0.0-5.0.2 - Authentication Bypass Using an Alternate Path or Channel

Title source: llm

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory vendor-advisory

https://lists.apache.org/thread/8wmcffly6gp50nmfw8j4w3hlmv843yo0

Mailing List

http://www.openwall.com/lists/oss-security/2025/09/30/7

Scores

CVSS v3 7.5

EPSS 0.0125

EPSS Percentile 65.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-288

Status published

Products (3)

apache/kylin 4.0.0 - 5.0.3

org.apache.kylin/kylin 4.0.0 - 5.0.3Maven

org.apache.kylin/kylin-core-common 4.0.0 - 5.0.3Maven

Published Oct 02, 2025

Tracked Since Feb 18, 2026