CVE-2025-68113 (GCVE-0-2025-68113)

Vulnerability from cvelistv5 – Published: 2025-12-16 00:53 – Updated: 2025-12-16 21:14
VLAI
Title
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Summary
ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions, which include version 1.0.0 of the altcha Golang package, version 1.0.0 of the altcha Rubygem, version 1.0.0 of the altcha pip package, version 1.0.0 of the altcha Erlang package, version 1.4.1 of the altcha-lib npm package, version 1.3.1 of the altcha-org/altcha Composer package, and version 1.3.0 of the org.altcha:altcha Maven package. As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `<salt>?expires=<time>&`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-16 21:13 UTC
CWE
  • CWE-115 - Misinterpretation of Input
  • CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
Impacted products
Vendor Product Version CPE status
altcha-org altcha-lib Affected: < 1.4.1
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T21:13:57.662095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T21:14:09.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "altcha-lib",
          "vendor": "altcha-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions, which include version 1.0.0 of the altcha Golang package, version 1.0.0 of the altcha Rubygem, version 1.0.0 of the altcha pip package, version 1.0.0 of the altcha Erlang package, version 1.4.1 of the altcha-lib npm package, version 1.3.1 of the altcha-org/altcha Composer package, and version 1.3.0 of the org.altcha:altcha Maven package. As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `\u003csalt\u003e?expires=\u003ctime\u003e\u0026`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-115",
              "description": "CWE-115: Misinterpretation of Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T00:53:59.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib-ex/commit/09b2bad466ad0338a5b24245380950ea9918333e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib-ex/commit/09b2bad466ad0338a5b24245380950ea9918333e"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib-go/commit/4a5610745ef79895a67bac858b2e4f291c2614b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib-go/commit/4a5610745ef79895a67bac858b2e4f291c2614b8"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib-php/commit/9e9e70c864a9db960d071c77c778be0c9ff1a4d0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib-php/commit/9e9e70c864a9db960d071c77c778be0c9ff1a4d0"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib-rb/commit/4fd7b64cbbfc713f3ca4e066c2dd466e3b8d359b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib-rb/commit/4fd7b64cbbfc713f3ca4e066c2dd466e3b8d359b"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib/commit/cb95d83a8d08e273b6be15e48988e7eaf60d5c08",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib/commit/cb95d83a8d08e273b6be15e48988e7eaf60d5c08"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib-java/releases/tag/v1.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib-java/releases/tag/v1.3.0"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib-php/releases/tag/v1.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib-php/releases/tag/v1.3.1"
        },
        {
          "name": "https://github.com/altcha-org/altcha-lib/releases/tag/1.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altcha-org/altcha-lib/releases/tag/1.4.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6gvq-jcmp-8959",
        "discovery": "UNKNOWN"
      },
      "title": "ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68113",
    "datePublished": "2025-12-16T00:53:59.401Z",
    "dateReserved": "2025-12-15T14:44:59.221Z",
    "dateUpdated": "2025-12-16T21:14:09.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68113",
      "date": "2026-10-07",
      "epss": "0.00463",
      "percentile": "0.38096"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "altcha-lib",
                "vendor": "altcha-org",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.4.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions, which include version 1.0.0 of the altcha Golang package, version 1.0.0 of the altcha Rubygem, version 1.0.0 of the altcha pip package, version 1.0.0 of the altcha Erlang package, version 1.4.1 of the altcha-lib npm package, version 1.3.1 of the altcha-org/altcha Composer package, and version 1.3.0 of the org.altcha:altcha Maven package. As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `\u003csalt\u003e?expires=\u003ctime\u003e\u0026`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator."
          },
          {
            "lang": "es",
            "value": "ALTCHA es un software que prioriza la privacidad para la protecci\u00f3n contra captcha y bots. Una falla de enlace sem\u00e1ntico criptogr\u00e1fico en las bibliotecas de ALTCHA permite el empalme de la carga \u00fatil del desaf\u00edo, lo que puede habilitar ataques de repetici\u00f3n. La firma HMAC no vincula de forma inequ\u00edvoca los par\u00e1metros del desaf\u00edo al nonce, permitiendo a un atacante reinterpretar una presentaci\u00f3n v\u00e1lida de prueba de trabajo con un valor de expiraci\u00f3n modificado. Esto puede permitir que los desaf\u00edos resueltos previamente se reutilicen m\u00e1s all\u00e1 de su vida \u00fatil prevista, dependiendo del manejo de repeticiones del lado del servidor y las suposiciones de despliegue. La vulnerabilidad impacta principalmente los mecanismos de prevenci\u00f3n de abuso, como la limitaci\u00f3n de velocidad y la mitigaci\u00f3n de bots. No afecta directamente la confidencialidad o integridad de los datos. Este problema ha sido abordado al aplicar una separaci\u00f3n sem\u00e1ntica expl\u00edcita entre los par\u00e1metros del desaf\u00edo y el nonce durante el c\u00e1lculo de HMAC. Se aconseja a los usuarios actualizar a versiones parcheadas, que incluyen la versi\u00f3n 1.0.0 del paquete altcha Golang, la versi\u00f3n 1.0.0 del Rubygem altcha, la versi\u00f3n 1.0.0 del paquete pip altcha, la versi\u00f3n 1.0.0 del paquete altcha Erlang, la versi\u00f3n 1.4.1 del paquete npm altcha-lib, la versi\u00f3n 1.3.1 del paquete Composer altcha-org/altcha y la versi\u00f3n 1.3.0 del paquete Maven org.altcha:altcha. Como mitigaci\u00f3n, las implementaciones pueden a\u00f1adir un delimitador al final del valor \u0027salt\u0027 antes del c\u00e1lculo de HMAC (por ejemplo, \u003csalt\u003e?expires=\u003ctime\u003e\u0026). Esto previene la ambig\u00fcedad entre los par\u00e1metros y el nonce y es compatible con versiones anteriores de implementaciones existentes, ya que el delimitador se trata como un separador de par\u00e1metros URL est\u00e1ndar."
          }
        ],
        "id": "CVE-2025-68113",
        "lastModified": "2026-10-07T19:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-68113",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T21:13:57.662095Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-16T01:15:53.383",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib-ex/commit/09b2bad466ad0338a5b24245380950ea9918333e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib-go/commit/4a5610745ef79895a67bac858b2e4f291c2614b8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib-java/releases/tag/v1.3.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib-php/commit/9e9e70c864a9db960d071c77c778be0c9ff1a4d0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib-php/releases/tag/v1.3.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib-rb/commit/4fd7b64cbbfc713f3ca4e066c2dd466e3b8d359b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib/commit/cb95d83a8d08e273b6be15e48988e7eaf60d5c08"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib/releases/tag/1.4.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-115"
              },
              {
                "lang": "en",
                "value": "CWE-347"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-12-17T08:07:13+00:00",
      "cve": "CVE-2025-68113",
      "id": "CVE-2025-68113",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68113.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-01-06T00:24:32Z",
      "cve": "CVE-2025-68113",
      "id": "CVE-2025-68113",
      "initial_release_date": "2026-01-06T00:24:32Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68113",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68113.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-68113",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-16T21:13:57.662095Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-16T21:14:05.428Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "altcha-lib",
              "vendor": "altcha-org",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.4.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions, which include version 1.0.0 of the altcha Golang package, version 1.0.0 of the altcha Rubygem, version 1.0.0 of the altcha pip package, version 1.0.0 of the altcha Erlang package, version 1.4.1 of the altcha-lib npm package, version 1.3.1 of the altcha-org/altcha Composer package, and version 1.3.0 of the org.altcha:altcha Maven package. As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `\u003csalt\u003e?expires=\u003ctime\u003e\u0026`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-115",
                  "description": "CWE-115: Misinterpretation of Input",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-347",
                  "description": "CWE-347: Improper Verification of Cryptographic Signature",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-16T00:53:59.401Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib-ex/commit/09b2bad466ad0338a5b24245380950ea9918333e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib-ex/commit/09b2bad466ad0338a5b24245380950ea9918333e"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib-go/commit/4a5610745ef79895a67bac858b2e4f291c2614b8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib-go/commit/4a5610745ef79895a67bac858b2e4f291c2614b8"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib-php/commit/9e9e70c864a9db960d071c77c778be0c9ff1a4d0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib-php/commit/9e9e70c864a9db960d071c77c778be0c9ff1a4d0"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib-rb/commit/4fd7b64cbbfc713f3ca4e066c2dd466e3b8d359b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib-rb/commit/4fd7b64cbbfc713f3ca4e066c2dd466e3b8d359b"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib/commit/cb95d83a8d08e273b6be15e48988e7eaf60d5c08",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib/commit/cb95d83a8d08e273b6be15e48988e7eaf60d5c08"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib-java/releases/tag/v1.3.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib-java/releases/tag/v1.3.0"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib-php/releases/tag/v1.3.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib-php/releases/tag/v1.3.1"
            },
            {
              "name": "https://github.com/altcha-org/altcha-lib/releases/tag/1.4.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/altcha-org/altcha-lib/releases/tag/1.4.1"
            }
          ],
          "source": {
            "advisory": "GHSA-6gvq-jcmp-8959",
            "discovery": "UNKNOWN"
          },
          "title": "ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-68113",
        "datePublished": "2025-12-16T00:53:59.401Z",
        "dateReserved": "2025-12-15T14:44:59.221Z",
        "dateUpdated": "2025-12-16T21:14:09.436Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.