Critical signature verification flaw in OpenPGP.js library allows message spoofing

A critical security vulnerability has been discovered in OpenPGP.js, a widely-used JavaScript cryptography library that powers encrypted communications in services like Proton Mail and other secure messaging platforms. 

The vulnerability is tracked as CVE-2025-47934 (CVSS score 8.7, project score Critical) and allows attackers to spoof digital signatures on messages, making modified content appear as if it were legitimately signed and verified. The vulnerability exploits a flaw in OpenPGP.js's openpgp.verify and openpgp.decrypt functions, which can be tricked into returning valid signature verification results for data that was not actually signed. 

The vulnerability impacts inline-signed messages (using openpgp.verify) and signed-and-encrypted messages (using openpgp.decrypt with verification keys). Detached signature verifications are not affected.

To exploit this vulnerability, an attacker needs access to two components: a single valid message signature (either inline or detached) and the plaintext data that was legitimately signed. With these elements, the attacker can construct a malicious message containing any content of their choice that will appear as legitimately signed by affected versions of OpenPGP.js.

When a maliciously crafted message is passed to the verification functions, the library incorrectly validates the signature against one piece of data while extracting different, attacker-controlled content as the "verified" message. 

The vulnerability affects:

• OpenPGP.js versions 5.0.1 through 5.11.2
• OpenPGP.js versions 6.0.0-alpha.0 through 6.1.0
• OpenPGP.js version 4 is not affected

OpenPGP.js maintainers have released patches to address the vulnerability:

• Version 5.11.3 (for v5 branch users)
• Version 6.1.1 (for v6 branch users)

For organizations unable to immediately upgrade, two workarounds are available:

1. For inline-signed messages: Extract the message and signature(s) from the message returned by openpgp.readMessage, then verify each signature as a detached signature by passing the signature and a new message containing only the data to openpgp.verify.
2. For signed-and-encrypted messages: Decrypt and verify in two separate steps by first calling openpgp.decrypt without verification keys, then passing the returned signatures and a new message containing the decrypted data to openpgp.verify.