An OpenPGP.js flaw just broke public key cryptography

There is a way to verify fake messages as if they were legitimate The bug affects multiple versions of OpenPGP.jsA patch is availableA security flaw in the JavaScript implementation of OpenPGP.js allows threat actors to verify fake messages as if they were legitimate, essentially breaking public key cryptography. This is according to security researchers Edoardo Geraci and Thomas Rinsma of Codean Labs, who found and recently reported the vulnerability.OpenPGP.js is an open-source JavaScript library that allows developers to encrypt, decrypt, sign, and verify messages using the OpenPGP standard. Normally, when a user signs a message digitally, it makes sure the content wasn’t tampered.But in this case, the vulnerability lets the threat actor change the message content, while still making it seem as if it had a valid signature.60% off for Techradar readersWith Aura's parental control software, you can filter, block, and monitor websites and apps, set screen time limits. Parents will also receive breach alerts, Dark Web monitoring, VPN protection, and antivirus.Preferred partner (What does this mean?)View DealApplying the patchIn theory, the vulnerability could be used for fake payment authorization, among other things. If a company used OpenPGP.js to verify digitally signed payment requests from its clients, an attacker could obtain a valid signed request, modify the payment details, and send it back, effectively stealing the money.Versions 5.0.1 to 5.12.2, and 6.0.0-alpha.0 to 6.1.0 of OpenPGP.js were said to be vulnerable, with the issue being patched in versions 5.11.3 and 6.1.1. Version 4 is safe, it was added.Those who cannot apply the patch immediately should at least apply the workaround. Users can check signatures separately instead of just trusting the system’s verification, or decrypt messages in two steps to make sure the data is not tampered with.The bug is now tracked as CVE-2025-47934 and has a severity score of 8.7/10 (high). There is currently no confirmed evidence of abuse in the wild. A proof-of-concept (PoC) and detailed analysis of the vulnerability is coming soon, the maintainers said, likely to give users enough time to apply the patch.Via The RegisterYou might also likeJavascript files loaded with RATs hits thousands of victimsTake a look at our guide to the best authenticator appWe've rounded up the best password managers