CVE-2025-68113: ALTCHA Libraries Vulnerable to Challenge Splicing and Replay Attacks
Summary
CVE-2025-68113: ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay. Affects altcha-lib versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Also tracked for
- altcha · PyPI
- github.com/altcha-org/altcha-lib-go · Go
The same CVE-2025-68113 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ALTCHA is a set of libraries designed for implementing proof-of-work mechanisms in various programming environments. It is widely used for abuse-prevention strategies, such as rate limiting and bot mitigation. However, a cryptographic flaw in its implementation can lead to significant security risks, particularly in how challenge parameters are handled.
Vulnerability Detail
The vulnerability arises from a cryptographic semantic binding flaw in the ALTCHA libraries, which allows for challenge payload splicing. This flaw permits attackers to reinterpret valid proof-of-work submissions by modifying the expiration value, potentially enabling replay attacks. The HMAC signature does not adequately bind challenge parameters to the nonce, leading to ambiguity that can be exploited. While this vulnerability does not directly compromise data confidentiality or integrity, it significantly undermines abuse-prevention mechanisms, allowing previously solved challenges to be reused beyond their intended lifetime.
How To Fix
Minimum fixed version
1.4.1
This is the first release that contains the fix.
npm install altcha-lib@1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary mitigation, implementations can append a delimiter to the end of the salt value before HMAC computation. For example:
const salt = '<salt>?expires=<time>&';
This approach prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations.
Conclusion
The ALTCHA libraries have a significant vulnerability that can lead to replay attacks due to a flaw in the HMAC signature binding. Users are strongly advised to upgrade to the patched versions of the affected packages and consider implementing the suggested workaround until they can fully update.
See every vulnerability recorded for altcha-lib →
FAQ
The vulnerability is a cryptographic semantic binding flaw that allows for challenge payload splicing, enabling replay attacks.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By checking your package-lock.json file, you can determine if your application is affected.
The primary consequence is the potential for replay attacks, which can undermine abuse-prevention mechanisms like rate limiting and bot mitigation.
Yes, patched versions of the affected packages are available. Users should upgrade to the specified versions to fix the vulnerability.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of risk.
