# Libsodium’s First Vulnerability, Ever - Threat Wire

Source: https://www.youtube.com/watch?v=qibhr5vneEk
Recap page: https://rapidrecap.app/video/qibhr5vneEk
Generated: 2026-01-14T15:38:35.205+00:00

---
## Quick Overview

The Libsodium encryption library, trusted for 13 years, announced its first-ever critical vulnerability, CVE-2025-69277, stemming from a missing check in its Edwards 25519 elliptic curve point validation function, prompting the creator to recommend switching to the restredto 255 group.

**Key Points:**
- Libsodium, an encryption library used for 13 years without incident, announced its first vulnerability, CVE-2025-69277, on December 30, 2025.
- The bug, rated with a base CVSS score of 4.5 by MITER, resulted from a missing subtraction and an is zero check when validating elliptic curve points in the Edwards 25519 implementation.
- The creator discovered the flaw while comparing Zigg and C implementations of the library and recommends users move to the restredto 255 group which is faster and requires no extra point checks.
- Four critical severity CVEs were announced for the NATN workflow automation tool within a two-week period, including two with perfect 10 CVSS scores (CVE-2026-21877 and CVE-2026-21858).
- One unauthenticated NATN vulnerability, CVE-2026-21858 ('nightmare'), allows reading local files and achieving RCE by overwriting the file handling function body due to failure to verify content type on a webhook call.
- California implemented the DROP Act on January 1st, 2026, allowing residents to submit universal deletion requests to data brokers via a government website, addressing the underutilization of the previous Delete Act.
- Anonymous hacker Martha Root gained notoriety for infiltrating three white supremacy dating sites, exfiltrating user data, taking the sites offline in real-time during a CCC talk, and sharing data with DOS Secrets.

**Context:** This weekly cybersecurity review from early 2026, hosted by Alli Diamond on Threatwire, covers several major security and privacy developments including new California digital privacy laws, a major security crisis affecting the NATN workflow automation tool, the first-ever vulnerability in the Libsodium encryption library, and a high-profile hack against hate groups detailed at the Chaos Communication Congress.

## Detailed Analysis

The broadcast details several significant cybersecurity events starting with California's new DROP (Delete Request and Opt Out Platform) law taking effect January 1st, 2026, which centralizes data deletion requests for residents, aiming to fix the previous Delete Act that only saw 1% utilization due to high barriers to entry. Next, the NATN workflow automation tool suffered a massive security failure, disclosing four critical severity CVEs in two weeks; three required authentication, but CVE-2026-21858 ('nightmare') allowed unauthenticated remote code execution via a flawed webhook handler. The most surprising news involved Libsodium, which maintained 13 years without a vulnerability until CVE-2025-69277 was announced due to a subtle error in Edwards 25519 point checking; the creator advised migrating to the restredto 255 group as a fix. Finally, the show highlighted an amazing CCC talk where hacker Martha Root took down three white supremacy dating sites in real-time after exfiltrating user data and sharing it with DOS Secrets.

### California Digital Privacy Updates

- The DROP law took effect January 1st, 2026, allowing universal deletion requests via a government website
- Previously, the Delete Act was underutilized, used by only 1% of residents in its first year due to demanding individual requests
- Brokers now have 45 days after August 2026 to comply with deletion notices.

### NATN Workflow Automation Crisis

- Four critical severity CVEs hit NATN within two weeks, with two scoring a perfect 10 CVSS
- CVE-2025-68613 (9.9) allowed arbitrary code execution via expression evaluation engine abuse after authenticated access
- CVE-2026-21858 (10) allowed RCE via overwriting the file handling function body due to improper content type verification on webhooks.

### Libsodium's First Vulnerability

- Libsodium, after 13 years of use, found its first CVE, CVE-2025-69277, with a 4.5 CVSS score
- The bug involved missing checks (subtraction and is zero check) in the Edwards 25519 elliptic curve point validation function
- The creator recommends switching to the restredto 255 group for a faster, safer alternative.

### High-Profile Hack at CCC

- Anonymous hacker Martha Root, dressed as a pink Power Ranger, detailed infiltrating and taking down three white supremacy dating sites during a CCC talk
- Martha Root simultaneously ran a script to delete user databases and owner emails in real-time
- Collected data was shared with the nonprofit DOS Secrets for archiving, prompting the site creator to call the actions 'cyber terrorism'.