A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-65849 · Microsoft / collected KEV context

EUVD-2025-201806

GHSA-mpmc-qchh-r9q8

cve-program · CVE-2025-65849

• https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194
• https://altcha.org/docs/v2/obfuscation/
• https://github.com/eternal-flame-AD/altcha-deobfs

euvd · EUVD-2025-201806

• https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194
• https://altcha.org/docs/v2/obfuscation/
• https://github.com/eternal-flame-AD/altcha-deobfs

nvd · CVE-2025-65849

• https://altcha.org/docs/v2/obfuscation/
• https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194
• https://github.com/eternal-flame-AD/altcha-deobfs

osv · GHSA-mpmc-qchh-r9q8

• https://nvd.nist.gov/vuln/detail/CVE-2025-65849
• https://altcha.org/docs/v2/obfuscation
• https://github.com/altcha-org/altcha
• https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194
• https://github.com/eternal-flame-AD/altcha-deobfs

No related operational record is retained in the current change model.