{"id":"CVE-2025-65849","aliases":["EUVD-2025-201806","GHSA-mpmc-qchh-r9q8"],"status":"disputed","title":"Altcha Proof-of-Work obfuscation mode cryptanalytic break","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is \"to discourage automated scraping / bots, not guarantee resistance to determined attackers.\" The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00236,"percentile":0.14626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-327"],"published":"2025-12-08T00:00:00Z","modified":"2026-10-18T15:10:00Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"altcha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"last_affected":"2.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"altcha","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"last_affected":"2.2.4"}]}]}],"references":[{"url":"https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194","tags":["web"]},{"url":"https://altcha.org/docs/v2/obfuscation/"},{"url":"https://github.com/eternal-flame-AD/altcha-deobfs","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65849","tags":["advisory"]},{"url":"https://altcha.org/docs/v2/obfuscation","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mpmc-qchh-r9q8"},{"url":"https://github.com/altcha-org/altcha","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-65849","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is \"to discourage automated scraping / bots, not guarantee resistance to determined attackers.\" The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”","status":"disputed","published":"2025-12-08T00:00:00Z","modified":"2025-12-11T14:36:52.373Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-201806","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is \"to discourage automated scraping / bots, not guarantee resistance to determined attackers.\" The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”","status":"published","published":"2025-12-08T00:00:00Z","modified":"2025-12-11T14:36:52Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:49:06.661228Z"}],"ghsa":[{"id":"GHSA-mpmc-qchh-r9q8","title":"Altcha Proof-of-Work obfuscation mode cryptanalytic break","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction.","status":"published","published":"2025-12-08T21:30:22Z","modified":"2025-12-12T19:39:36Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2025-65849","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is \"to discourage automated scraping / bots, not guarantee resistance to determined attackers.\" The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”","status":"disputed","published":"2025-12-08T19:15:50.817Z","modified":"2026-10-18T15:10:00.097Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:11:49.093461Z"}],"osv":[{"id":"GHSA-mpmc-qchh-r9q8","title":"Altcha Proof-of-Work obfuscation mode cryptanalytic break","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction.","status":"published","published":"2025-12-08T21:30:22Z","modified":"2025-12-12T20:08:03.446058Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}