CVE-2025-68113

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to...

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Impact A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modifi...

PT-2025-51359

Name of the Vulnerable Software and Affected Versions ALTCHA versions prior to 1.0.0 Golang package ALTCHA versions prior to 1.0.0 Rubygem package ALTCHA versions prior to 1.0.0 pip package ALTCHA versions prior to 1.0.0 Erlang package ALTCHA versions prior to 1.4.1 altcha-lib npm package ALTCHA...