Cryptographic Binding Flaw in ALTCHA Privacy Software for Captcha Protection

CVE-2025-68113

What is CVE-2025-68113?

A cryptographic binding flaw in ALTCHA's libraries allows for challenge payload splicing, potentially enabling replay attacks. The HMAC signature fails to bind challenge parameters unambiguously to the nonce, which could allow attackers to reuse valid proof-of-work submissions with altered expiration values. This vulnerability mainly affects abuse-prevention mechanisms such as rate limiting and bot mitigation controls, although it does not directly compromise data confidentiality or integrity. To mitigate this issue, it is recommended to upgrade to patched versions and consider implementing a delimiter in the salt value during HMAC computation to prevent ambiguity.

References