Apache Kylin versions 4.0.0 through 5.0.2 are affected by an authentication bypass vulnerability (CVE-2025-61733). This flaw allows an attacker to bypass authentication using an alternate path or channel. The issue is fixed in version 5.0.3, which users are advised to upgrade to.