Skip to content
OpenAdvisories
High · 7.5 CVE-2025-61733 EUVD-2025-32642GHSA-mr9j-4j48-xcm2

Apache Kylin: Authentication bypass

Published Oct 2, 2025 · Updated Feb 26, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Kylin Package: org.apache.kylin:kylin Package: org.apache.kylin:kylin-core-common Ecosystem: Maven

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin.

This issue affects Apache Kylin: from 4.0.0 through 5.0.2.

Users are recommended to upgrade to version 5.0.3, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Kylin 4.0.0 – ≤ 5.0.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.kylin:kylin >= 4.0.0, < 5.0.3 5.0.3 GHSA-mr9j-4j48-xcm2
Maven org.apache.kylin:kylin-core-common >= 4.0.0, < 5.0.3 5.0.3 GHSA-mr9j-4j48-xcm2

References