CVE-2025-61733
BaseFortify
Publication date: 2025-10-02
Last updated on: 2025-11-04
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | kylin | From 4.0.0 (inc) to 5.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Authentication Bypass Using an Alternate Path or Channel in Apache Kylin versions 4.0.0 through 5.0.2. It allows an attacker to bypass the normal authentication mechanisms by exploiting an alternate path or channel, potentially gaining unauthorized access.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to bypass authentication and gain access to the Apache Kylin system, which could lead to unauthorized data access or manipulation.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache Kylin to version 5.0.3, which fixes the authentication bypass vulnerability.