OpenPGP.js Vulnerability Let Attackers Spoof Message Signature Verification

A critical vulnerability in the widely-used OpenPGP.js library has been discovered that allows attackers to forge digital signatures and deceive users into believing malicious content was legitimately signed by trusted sources. The flaw, designated CVE-2025-47934, represents a fundamental breach of cryptographic trust that could undermine secure communications across numerous web-based applications and email clients that […] The post OpenPGP.js Vulnerability Let Attackers Spoof Message Signature Verification appeared first on Cyber Security News.

Jun 12, 2025 - 19:20

OpenPGP.js Vulnerability Let Attackers Spoof Message Signature Verification

A critical vulnerability in the widely-used OpenPGP.js library has been discovered that allows attackers to forge digital signatures and deceive users into believing malicious content was legitimately signed by trusted sources.

The flaw, designated CVE-2025-47934, represents a fundamental breach of cryptographic trust that could undermine secure communications across numerous web-based applications and email clients that rely on the popular JavaScript implementation of the OpenPGP standard.

The vulnerability affects OpenPGP.js versions prior to v5.11.3 and v6.1.1, potentially impacting millions of users who depend on encrypted email services and other applications utilizing the library for secure communications.

Notable affected platforms include Mailvelope and potentially other web-based email clients, though Proton Mail was confirmed to be unaffected by this specific issue.

The severity of this vulnerability stems from its ability to completely subvert the core principle of digital signature verification, allowing attackers to present arbitrary malicious content while maintaining the appearance of a valid cryptographic signature from a legitimate source.

Codean Labs researchers identified this vulnerability through their security research program, demonstrating how an attacker with access to any valid signature from a target user could manipulate the verification process to authenticate completely different content.

The research team successfully demonstrated the attack by showing how a legitimate signature on the word “legitimate” could be manipulated to appear as a valid signature on the word “malicious” while maintaining cryptographic verification success.

The discovery has prompted immediate action from the OpenPGP.js development team, who released patches addressing the vulnerability and implementing stricter grammar verification to prevent similar attacks in the future.

The coordinated disclosure process began in early May 2025, with fixes and advisories published within two weeks of acknowledgment by the maintainers.

Technical Exploitation Mechanism

The vulnerability exploits a critical flaw in how OpenPGP.js processes packet lists during message verification.

The attack leverages the library’s flexible handling of compressed and uncompressed data packets, creating a scenario where signature verification and data extraction operate on different packet sequences within the same message.

An attacker constructs a malformed packet list by taking a legitimate signed message and appending a malicious Compressed Data packet containing arbitrary content.

The resulting structure includes the original One-Pass Signature packet, Literal Data packet with legitimate content, a valid Signature packet, followed by the attacker-controlled Compressed Data packet containing malicious payload.

During the verification process, OpenPGP.js first reads packets until it encounters a streamable packet type, initially processing only the legitimate signed content.

The unwrapCompressed() method examines this limited packet list and finds no compressed data, so it verifies the signature against the legitimate content successfully.

However, when the library subsequently retrieves the message data for return to the user, it re-examines the now-complete packet list and extracts content from the first Compressed Data packet it encounters, which contains the attacker’s malicious payload.

const verificationResult = await openpgp.verify({ message, verificationKeys: publicKey });
console.log(`Signed message data: ${verificationResult.data}`); // Returns malicious content
const { verified } = verificationResult.signatures[0];
await verified; // Signature verification succeeds

This timing discrepancy in packet processing creates a dangerous disconnect between what content is cryptographically verified and what content is presented to the user, fundamentally breaking the security guarantee that digital signatures are supposed to provide.

Automate threat response with ANY.RUN’s TI Feeds—Enrich alerts and block malicious IPs across all endpoints -> Request full access

The post OpenPGP.js Vulnerability Let Attackers Spoof Message Signature Verification appeared first on Cyber Security News.