-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, CVE-2025-69277, stems from an incomplete check in the crypto_core_ed25519_is_valid_point function of the libsodium library. This function is responsible for validating if an Ed25519 elliptic curve point is on the main cryptographic subgroup. The original implementation only checked if the X-coordinate of the point (after multiplication by the curve's cofactor) was zero, but failed to check the other coordinates. This allowed certain invalid points, which are not part of the main subgroup, to be accepted as valid.
This vulnerability affects multiple packages that use libsodium or implement its logic:
libsodium: The core vulnerability lies in the ge25519_is_on_main_subgroup C function, which is called by crypto_core_ed25519_is_valid_point. The patch ad3004ec8731730e93fcfbbc824e67eadc1c1bae corrects this by adding a check to ensure that Y-Z is also zero, thus fully validating the point as the identity element.
PyNaCl and hdwallet: These Python packages bundle the libsodium library. They are vulnerable because they expose the flawed crypto_core_ed25519_is_valid_point functionality. Any operation in these libraries that involves verifying an Ed25519 public key would be affected. The fix for these packages was to update the bundled libsodium to a patched version.
paragonie/sodium_compat: This is a pure PHP reimplementation of the libsodium library. It had a similar vulnerability where functions accepting public keys (pk_to_curve25519, verify_detached, and File::verify) either had an incomplete check or were missing the check for the public key being on the main subgroup entirely. The patches 2cb48f26130919f92f30650bdcc30e6f4ebe45ac and 4714da6efdc782c06690bc72ce34fae7941c2d9f introduced a new function, is_on_main_subgroup, and added calls to it in the vulnerable functions to ensure proper validation of public keys.
ge25519_is_on_main_subgroupsrc/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
crypto_core_ed25519_is_valid_pointsrc/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
ParagonIE_Sodium_Core_Ed25519::pk_to_curve25519src/Core/Ed25519.php
ParagonIE_Sodium_Core_Ed25519::verify_detachedsrc/Core/Ed25519.php
ParagonIE_Sodium_File::verifysrc/File.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| paragonie/sodium_compat | composer | >= 2, < 2.5.0 | 2.5.0 |
| paragonie/sodium_compat | composer | < 1.24.0 | 1.24.0 |
| PyNaCl |
| pip |
| < 1.6.2 |
| 1.6.2 |
| hdwallet | pip | < 3.6.1 | 3.6.1 |