QwikSec

Security Database

CVE

CWE

Training

CVE-2025-69277

Published: Dec 31, 2025

Modified: Jan 7, 2026

PUBLISHED

CVSS v3.1

4.5

MEDIUM

Description

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

Vendor	Product	Versions
libsodium	libsodium	affected `0 - < ad3004ec8731730e93fcfbbc824e67eadc1c1bae`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae

https://00f.net/2025/12/30/libsodium-vulnerability/

https://news.ycombinator.com/item?id=46435614

https://ianix.com/pub/ed25519-deployment.html

https://github.com/pyca/pynacl/issues/920

https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf

https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.