The vulnerability is found in phpseclib's pure‑PHP implementation of X25519 scalar multiplication in Math/PrimeField/Integer.php. During the Montgomery ladder, data‑dependent conditional modular reductions create timing and libgmp call‑count variations that depend on the secret scalar prefix. This side channel allows a local observer to recover the full 251‑bit clamped private key when the key is reused, permitting any operation that reuses the key to be compromised. The flaw is a timing side‑channel that results in private‑key disclosure.

Applications or scripts that use phpseclib before version 3.0.57 or 4.0.1, relying on the pure‑PHP X25519 path and where the ext‑sodium engine is not available, are affected. Long‑lived or reused private keys exposed to a local observer are vulnerable. Ephemeral keys and the native engine path are not impacted.

With a CVSS score of 6.3 the attack is considered moderate. Exploitation requires the attacker to observe the timing or libgmp call patterns of the pure‑PHP ladder, know the corresponding public key, and have access to a reused private key. While the EPSS is not provided, the attack is feasible in environments where such observations can be captured locally. The vulnerability is not yet listed in the CISA KEV catalog, but the fix is available in phpseclib 3.0.57 and 4.0.1.