Vulnerability · Published Dec 16, 2025 · Assigned by GitHub_M
CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Medium 6.5
In plain English
A medium-severity security flaw in altcha-lib from altcha-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions, which include version 1.0.0 of the altcha Golang package, version 1.0.0 of the altcha Rubygem, version 1.0.0 of the altcha pip package, version 1.0.0 of the altcha Erlang package, version 1.4.1 of the altcha-lib npm package, version 1.3.1 of the altcha-org/altcha Composer package, and version 1.3.0 of the org.altcha:altcha Maven package. As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `<salt>?expires=<time>&`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/altcha-org/altcha-lib-go | 1.0.0 | GHSA-6gvq-jcmp-8959 |
| Go | github.com/altcha-org/altcha-lib-go | 1.0.0 | GO-2025-4239 |
| Maven | org.altcha:altcha | 1.3.0 | GHSA-6gvq-jcmp-8959 |
| Packagist | altcha-org/altcha | 1.3.1 | GHSA-6gvq-jcmp-8959 |
| PyPI | altcha | 1.0.0 | GHSA-6gvq-jcmp-8959 |
| PyPI | altcha | 1.0.0 | PYSEC-2026-1115 |
| RubyGems | altcha | 1.0.0 | GHSA-6gvq-jcmp-8959 |
| npm | altcha-lib | 1.4.1 | GHSA-6gvq-jcmp-8959 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| altcha-org | altcha-lib | < 1.4.1 |
Weakness: CWE-115, CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959 x_refsource_CONFIRM
- https://github.com/altcha-org/altcha-lib-ex/commit/09b2bad466ad0338a5b24245380950ea9918333e x_refsource_MISC
- https://github.com/altcha-org/altcha-lib-go/commit/4a5610745ef79895a67bac858b2e4f291c2614b8 x_refsource_MISC
- https://github.com/altcha-org/altcha-lib-java/commit/69277651fdd6418ae10bf3a088901506f9c62114 x_refsource_MISC
- https://github.com/altcha-org/altcha-lib-php/commit/9e9e70c864a9db960d071c77c778be0c9ff1a4d0 x_refsource_MISC
- https://github.com/altcha-org/altcha-lib-rb/commit/4fd7b64cbbfc713f3ca4e066c2dd466e3b8d359b x_refsource_MISC
- https://github.com/altcha-org/altcha-lib/commit/cb95d83a8d08e273b6be15e48988e7eaf60d5c08 x_refsource_MISC
- https://github.com/altcha-org/altcha-lib-java/releases/tag/v1.3.0 x_refsource_MISC
- https://github.com/altcha-org/altcha-lib-php/releases/tag/v1.3.1 x_refsource_MISC
- https://github.com/altcha-org/altcha-lib/releases/tag/1.4.1 x_refsource_MISC