{"id":"GHSA-mpmc-qchh-r9q8","summary":"Altcha Proof-of-Work obfuscation mode cryptanalytic break","details":"A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction.","aliases":["CVE-2025-65849"],"modified":"2025-12-12T20:08:03.446058Z","published":"2025-12-08T21:30:22Z","database_specific":{"nvd_published_at":"2025-12-08T19:15:50Z","cwe_ids":["CWE-327"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-12-09T14:26:12Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65849"},{"type":"WEB","url":"https://altcha.org/docs/v2/obfuscation"},{"type":"PACKAGE","url":"https://github.com/altcha-org/altcha"},{"type":"WEB","url":"https://github.com/altcha-org/altcha/blob/154f874cbcdd4e639783463130d13988a2bd1bdc/src/helpers.ts#L170-L194"},{"type":"WEB","url":"https://github.com/eternal-flame-AD/altcha-deobfs"}],"affected":[{"package":{"name":"altcha","ecosystem":"npm","purl":"pkg:npm/altcha"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"last_affected":"2.2.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mpmc-qchh-r9q8/GHSA-mpmc-qchh-r9q8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}