{"id":"EUVD-2025-201806","enisaUuid":"03d50f28-b9b7-3a13-8e04-16f8341c8cb8","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product\u0027s objective is \"to discourage automated scraping / bots, not guarantee resistance to determined attackers.\" The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”","datePublished":"Dec 8, 2025, 12:00:00 AM","dateUpdated":"Dec 11, 2025, 2:36:52 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194\nhttps://altcha.org/docs/v2/obfuscation/\nhttps://github.com/eternal-flame-AD/altcha-deobfs\n","aliases":"CVE-2025-65849\nGHSA-mpmc-qchh-r9q8\n","assigner":"mitre","epss":0.22,"enisaIdProduct":[{"id":"8498928f-79e0-3c80-800e-f68f05391199","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"dc8aaeb3-89a3-378d-89dc-7c01a8306f90","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"79f15d94-fde3-3bfa-965e-b06a1b5959e7","vulnerability":{"id":"GHSA-mpmc-qchh-r9q8","description":"Altcha Proof-of-Work obfuscation mode cryptanalytic break","datePublished":"Dec 8, 2025, 9:30:22 PM","dateUpdated":"Dec 12, 2025, 7:39:35 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-65849\nhttps://altcha.org/docs/v2/obfuscation\nhttps://github.com/altcha-org/altcha\nhttps://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194\nhttps://github.com/eternal-flame-AD/altcha-deobfs\n","enisa_id":"EUVD-2025-201806\n","aliases":"GHSA-mpmc-qchh-r9q8\nCVE-2025-65849\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a5ba0674-1eac-3ee8-98b0-c805ca0308b8","vulnerability":{"id":"CVE-2025-65849","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product\u0027s objective is \"to discourage automated scraping / bots, not guarantee resistance to determined attackers.\" The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”","datePublished":"Dec 8, 2025, 12:00:00 AM","dateUpdated":"Dec 11, 2025, 2:36:52 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194\nhttps://altcha.org/docs/v2/obfuscation/\nhttps://github.com/eternal-flame-AD/altcha-deobfs\n","enisa_id":"EUVD-2025-201806\n","assigner":"mitre","epss":0.22,"dataProcessed":"Nov 8, 2026, 7:20:11 AM","vulnerabilityProduct":[{"id":"9af2d2f7-b4fa-3f12-8d6b-bc6eace4c475","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"cea85c5f-cdec-30aa-b994-5633ab85c7f4","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[]}