CVE-2025-65849

Description

A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the products objective is to discourage automated scraping / bots, not guarantee resistance to determined attackers. The documentation states the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.

Risk Information

Base Score

9.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score

Exploitation Probability

0.018

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-65849 are affected in Ruby-altcha 2.2.4	Windows
Vulnerabilities CVE-2025-65849 are affected in Ruby-altcha for Linux 2.2.4	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234