CVE-2025-65951
Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted bet ticket, allowing the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. This issue has been patched via commit 2d38d2f.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- EPSS probability
- 0.12%
- CWE
- CWE-200, CWE-327
- Published
- 2025-11-25
- Last modified
- 2026-03-12
Affected products
- mescuwa entropy-derby
Weakness type
Related vulnerabilities
- CVE-2026-87017 — Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
- CVE-2026-86767 — Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
- CVE-2026-87820 — CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
- CVE-2026-87810 — Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock
- CVE-2026-87032 — Tanium addressed an information disclosure vulnerability in Tanium Server.
- CVE-2026-87035 — Tanium addressed an information disclosure vulnerability in Comply.
- CVE-2026-87593 — Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87437 — Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...