High severity8.7OSV Advisory· Published Nov 25, 2025· Updated Apr 15, 2026

CVE-2025-65951

Description

Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted bet ticket, allowing the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. This issue has been patched via commit 2d38d2f.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mescuwa/Entropy DerbyOSV2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: < commit 2d38d2f

Patches

Vulnerability mechanics

References

github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77nvd
github.com/mescuwa/entropy-derby/security/advisories/GHSA-pm54-f847-w4mhnvd

News mentions

No linked articles in our index yet.

cvss	0.565
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000