CVE-2025-68113

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-68113
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68113.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68113
Aliases
Published
2025-12-16T00:53:59.401Z
Modified
2025-12-17T05:44:45.621620Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Details

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions, which include version 1.0.0 of the altcha Golang package, version 1.0.0 of the altcha Rubygem, version 1.0.0 of the altcha pip package, version 1.0.0 of the altcha Erlang package, version 1.4.1 of the altcha-lib npm package, version 1.3.1 of the altcha-org/altcha Composer package, and version 1.3.0 of the org.altcha:altcha Maven package. As a mitigation, implementations may append a delimiter to the end of the salt value prior to HMAC computation (for example, <salt>?expires=<time>&). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator.

Database specific 
{
    "cwe_ids": [
        "CWE-115",
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68113.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git

github.com/altcha-org/altcha-lib

Affected ranges

Type
GIT
Repo
https://github.com/altcha-org/altcha-lib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
28051b3a8f8382eba3310512c99c89af79a62170
Fixed
cb95d83a8d08e273b6be15e48988e7eaf60d5c08

Affected versions

0.*

0.1.0
0.1.1
0.1.2
0.1.3
0.1.5
0.2.0
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1

1.*

1.0.0
1.1.0
1.1.1
1.2.0
1.3.0
1.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68113.json"

github.com/altcha-org/altcha-lib-ex

Affected ranges

Type
GIT
Repo
https://github.com/altcha-org/altcha-lib-ex
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
09b2bad466ad0338a5b24245380950ea9918333e

Affected versions

v0.*

v0.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68113.json"

github.com/altcha-org/altcha-lib-go

Affected ranges

Type
GIT
Repo
https://github.com/altcha-org/altcha-lib-go
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4a5610745ef79895a67bac858b2e4f291c2614b8

Affected versions

v0.*

v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.2.0
v0.2.1
v0.2.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68113.json"

github.com/altcha-org/altcha-lib-java

Affected ranges

Type
GIT
Repo
https://github.com/altcha-org/altcha-lib-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
69277651fdd6418ae10bf3a088901506f9c62114
Fixed
ff9a12dc52b091fe4c73be9abd472b23736c2bbe

Affected versions

v1.*

v1.0-SNAPSHOT
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.2
v1.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68113.json"

vanir_signatures

[
    {
        "target": {
            "file": "src/test/java/org/altcha/altcha/AltchaTest.java"
        },
        "id": "CVE-2025-68113-066935f5",
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "4144237906745928338027145242928258170",
                "4489937542977049774966521461638520737",
                "267395484612633614074774011994317497372"
            ],
            "threshold": 0.9
        }
    },
    {
        "target": {
            "file": "src/main/java/org/altcha/altcha/Altcha.java"
        },
        "id": "CVE-2025-68113-183b2ae1",
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "41305554841059778560061935860290602967",
                "331440105487163713075316558123141105492",
                "36231788414434089328870211343861145095"
            ],
            "threshold": 0.9
        }
    },
    {
        "target": {
            "function": "createChallenge",
            "file": "src/main/java/org/altcha/altcha/Altcha.java"
        },
        "id": "CVE-2025-68113-4b1e48fa",
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114",
        "signature_version": "v1",
        "digest": {
            "function_hash": "233896706516170834477256249579805287166",
            "length": 946.0
        }
    }
]

github.com/altcha-org/altcha-lib-php

Affected ranges

Type
GIT
Repo
https://github.com/altcha-org/altcha-lib-php
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9e9e70c864a9db960d071c77c778be0c9ff1a4d0

Affected versions

v0.*

v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4

v1.*

v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68113.json"

github.com/altcha-org/altcha-lib-rb

Affected ranges

Type
GIT
Repo
https://github.com/altcha-org/altcha-lib-rb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4fd7b64cbbfc713f3ca4e066c2dd466e3b8d359b

Affected versions

0.*

0.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68113.json"