CVE-2025-65951

HIGH

Inside Track / Entropy Derby <2d38d2f - Info Disclosure

Title source: llm
STIX 2.1

Description

Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted bet ticket, allowing the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. This issue has been patched via commit 2d38d2f.

References (2)

Scores

CVSS v3 8.7
EPSS 0.0001
EPSS Percentile 1.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-200 CWE-327
Status published
Products (1)
mescuwa/entropy-derby < 2d38d2f16bbb3b4240698148f80d8c5202725c77
Published Nov 25, 2025
Tracked Since Feb 18, 2026