CVE-2025-65951CWE-200CWE-327information-disclosure

CVE-2025-65951

High · published November 25, 2025

CVSS v3.1
8.7
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

⚡ A sneaky loophole lets the betting house decrypt bets instantly! Before commit 2d38d2f, the VDF-based timelock encryption system didn’t enforce the sequential delay, making it a wild ride for bettors. 🏇💰 Think of it like a race where the house knows the finish line before the horses even leave the gate. Bettors' tickets are like cheat sheets that let the house skip the complex part of VDF evaluation—a serious unfair advantage! If exploited, this flaw could allow betting operators to outpace bettors by decrypting bet tickets immediately, undermining the entire betting process. Imagine the chaos and distrust if the house always had the upper hand, potentially leading to huge financial losses for genuine players!

Put simply

Think of it like a race where the house knows the finish line before the horses even leave the gate. Bettors' tickets are like cheat sheets that let the house skip the complex part of VDF evaluation—a serious unfair advantage! This vulnerability stems from the VDF implementation in the betting engine that fails to enforce the necessary sequential delays, enabling immediate decryption of bets instead of the intended time-locked process.

What to do

If exploited, this flaw could allow betting operators to outpace bettors by decrypting bet tickets immediately, undermining the entire betting process. Imagine the chaos and distrust if the house always had the upper hand, potentially leading to huge financial losses for genuine players! Patch the system by applying commit 2d38d2f to restore the proper sequential delay enforcement. Ensure that your deployment reflects this fix to maintain fair betting practices! You've got this! By taking action now, you protect the integrity of your betting platform and keep the odds fair. 🛡️

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00118 · 1.6th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2025-11-25T06:15Z
References (2)
EPSS history
Timeline
  • 25 NOV 00:30Z
    Inside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage
    cvelistv5