CVE-2025-65951
High
Description
Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted bet ticket, allowing the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. This issue has been patched via commit 2d38d2f.
SeverityHigh
CVSS8.7
Exploit probability—
ProductMescuwa Entropy-derby
PublishedNov 25, 2025
First seenNov 25, 2025
Weakness typeCWE-200Sensitive information exposureCWE-327CWE-327
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mescuwa entropy-derby | < 2d38d2f16bbb3b4240698148f80d8c5202725c77 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.