CVE-2025-65951

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-65951
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65951.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-65951
Aliases
  • GHSA-pm54-f847-w4mh
Published
2025-11-25T00:30:14.735Z
Modified
2026-04-02T13:00:50.735919Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Inside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage
Details

Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted bet ticket, allowing the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. This issue has been patched via commit 2d38d2f.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65951.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-327"
    ]
}
References

Affected packages

Git / github.com/mescuwa/entropy-derby

Affected ranges

Type
GIT
Repo
https://github.com/mescuwa/entropy-derby
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2d38d2f16bbb3b4240698148f80d8c5202725c77

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65951.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "123327532239466734606915968532130560491",
            "length": 968.0
        },
        "source": "https://github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77",
        "id": "CVE-2025-65951-00b7eec5",
        "target": {
            "file": "src/parimutuel.cpp",
            "function": "ParimutuelRaceSession::recordEncrypted"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "140651297649308495900693859138106540907",
                "310301484660144894104904583411693618239",
                "151231967049573252747222768817757230344",
                "156782812239693962956097685027234665818",
                "75205843202029447903883891093294751347",
                "56848436622654942628934877947817323064",
                "331507281884335808339676016241271173450",
                "170229792450295516587757451127922874324",
                "179854594332638907623476577087262904886",
                "21005042295616617998584913056689261983",
                "191765770306653873012966436714608189421",
                "69029439854345303351945999298097448255",
                "172642106976532112457758449482051252071",
                "155432891444461523650751472113485249403",
                "286776209710745407629827680996027618064",
                "63079997396866991756105311565380496752",
                "122496463829804009358992087245387412431"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77",
        "id": "CVE-2025-65951-1aa1ff0d",
        "target": {
            "file": "src/timelock_encryption.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "175106529590088889581550919612525460496",
                "18393408500950457221821269898059241358",
                "320591210685372636764959366687810170128",
                "44736631654534907538566740106579303837",
                "321244615547724365319820388460456325135"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77",
        "id": "CVE-2025-65951-1f2d3ef9",
        "target": {
            "file": "src/parimutuel.cpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "2547426039406505168728058048701656251",
                "110603845127933529108064861187538453525",
                "313530662736052140744777982282500846976",
                "63329906287809917066451241394954408158",
                "251192175471304835855550358328934357919"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77",
        "id": "CVE-2025-65951-456f5d5c",
        "target": {
            "file": "include/timelock_encryption.hpp"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "105673158010065107965695096454773038684",
            "length": 1156.0
        },
        "source": "https://github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77",
        "id": "CVE-2025-65951-702dd8b2",
        "target": {
            "file": "src/timelock_encryption.cpp",
            "function": "TimeLockEncryptor::decrypt"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "194248410118653568204259268323854213618",
            "length": 1264.0
        },
        "source": "https://github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77",
        "id": "CVE-2025-65951-7cac67a8",
        "target": {
            "file": "src/timelock_encryption.cpp",
            "function": "TimeLockEncryptor::encrypt"
        }
    }
]