{"id":"EUVD-2025-201806","revision":"ab566e7b6b1c4934a11c69b2cc9552f8","records":[{"revision":"ab566e7b6b1c4934a11c69b2cc9552f8","observedAt":"2026-11-09T04:08:24.259+00:00","statement":{"source":"euvd","id":"EUVD-2025-201806","aliases":["CVE-2025-65849","GHSA-mpmc-qchh-r9q8"],"title":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because…","description":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is \"to discourage automated scraping / bots, not guarantee resistance to determined attackers.\" The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":null}],"references":["https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194","https://altcha.org/docs/v2/obfuscation/","https://github.com/eternal-flame-AD/altcha-deobfs"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201806","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 8, 2025, 12:00:00 AM","dateUpdated":"Dec 11, 2025, 2:36:52 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-201806","identifiers":["EUVD-2025-201806","CVE-2025-65849","GHSA-mpmc-qchh-r9q8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}