PT-2025-47978 · Unknown · Inside Track / Entropy Derby

Published 2025-11-25 · Updated 2025-11-30 · CVE-2025-65951

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Inside Track / Entropy Derby versions prior to commit 2d38d2f

Description The VDF-based timelock encryption system in Inside Track / Entropy Derby fails to enforce sequential delay against the betting operator. This allows bettors to pre-compute the entire Wesolowski VDF and include the vdfOutputHex in their encrypted bet ticket, enabling the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. The issue was addressed with commit 2d38d2f.

Recommendations Update to commit 2d38d2f or later to resolve this issue.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Information Disclosure

Weakness Enumeration

CWE-327

CWE-200

Related Identifiers

CVE-2025-65951

GHSA-PM54-F847-W4MH

Affected Products

Inside Track / Entropy Derby

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65951.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65951 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65951 · Vendor Advisory
• https://twitter.com/CVEnew/status/1993125713365594448 · Twitter Post
• https://github.com/mescuwa/entropy-derby/security/advisories/GHSA-pm54-f847-w4mh · Note
• https://t.me/cveNotify/143894 · Telegram Post
• https://twitter.com/gothburz/status/1993742949184688238 · Twitter Post
• https://t.me/CVEtracker/38140 · Telegram Post
• https://github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77 · Note
• https://twitter.com/gothburz/status/1993742948102529155 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993168916433043650 · Twitter Post
• https://twitter.com/CveFindCom/status/1993132632201134117 · Twitter Post
• https://twitter.com/cracbot/status/1995085445169123437 · Twitter Post