PT-2025-51359 · Composer+3 · Altcha-Org/Altcha+3

Published 2025-12-16 · Updated 2026-01-06 · CVE-2025-68113

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions ALTCHA versions prior to 1.0.0 (Golang package) ALTCHA versions prior to 1.0.0 (Rubygem package) ALTCHA versions prior to 1.0.0 (pip package) ALTCHA versions prior to 1.0.0 (Erlang package) ALTCHA versions prior to 1.4.1 (altcha-lib npm package) ALTCHA versions prior to 1.3.1 (altcha-org/altcha Composer package) ALTCHA versions prior to 1.3.0 (org.altcha:altcha Maven package)

Description A cryptographic semantic binding flaw exists in ALTCHA libraries, potentially enabling replay attacks. The HMAC signature does not sufficiently bind challenge parameters to the nonce, allowing an attacker to modify the expiration value of a valid proof-of-work submission. This could allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling. The issue impacts abuse-prevention mechanisms like rate limiting and bot mitigation but does not directly affect data confidentiality or integrity. The flaw arises from a lack of explicit semantic separation between challenge parameters and the nonce during HMAC computation.

Recommendations Upgrade to version 1.0.0 of the altcha Golang package. Upgrade to version 1.0.0 of the altcha Rubygem package. Upgrade to version 1.0.0 of the altcha pip package. Upgrade to version 1.0.0 of the altcha Erlang package. Upgrade to version 1.4.1 of the altcha-lib npm package. Upgrade to version 1.3.1 of the altcha-org/altcha Composer package. Upgrade to version 1.3.0 of the org.altcha:altcha Maven package. As a mitigation, append a delimiter to the end of the salt value prior to HMAC computation (for example, <salt>?expires=<time>&).

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-115

Related Identifiers

CVE-2025-68113

GHSA-6GVQ-JCMP-8959

GO-2025-4239

SUSE-SU-2026:0037-1

Affected Products

Altcha

Altcha-Lib

Altcha-Org/Altcha

Org.Altcha:Altcha

References · 98

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68113.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/altcha/CVE-2025-68113.yml · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68113 · Security Note
• https://osv.dev/vulnerability/GHSA-6gvq-jcmp-8959 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68113 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4239 · Vendor Advisory
• https://github.com/altcha-org/altcha-lib/releases/tag/1.4.1 · Note
• https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959 · Note
• https://github.com/altcha-org/altcha-lib/commit/cb95d83a8d08e273b6be15e48988e7eaf60d5c08 · Note
• https://github.com/altcha-org/altcha-lib · Note
• https://github.com/altcha-org/altcha-lib-php/commit/9e9e70c864a9db960d071c77c778be0c9ff1a4d0 · Note
• https://github.com/altcha-org/altcha-lib-php/releases/tag/v1.3.1 · Note
• https://github.com/altcha-org/altcha-lib-go/commit/4a5610745ef79895a67bac858b2e4f291c2614b8 · Note
• https://github.com/altcha-org/altcha-lib-java/releases/tag/v1.3.0 · Note