Description
Versions of openpgp prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type text. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as standalone or timestamp).
Recommendation
Update the openpgp package to the latest compatible version. Followings are version details:
- Affected version(s): <= 4.1.2
- Patched version(s): 4.2.0
References
Could your website be exposed too?
SmartScanner can check your website for Message Signature Bypass in openpgp and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cleartext Signed Message Signature Spoofing in openpgp - CVE-2023-41037
- OpenPGP.js's message signature verification can be spoofed - CVE-2025-47934
- OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover - CVE-2026-44720
- Improper Key Verification in openpgp - CVE-2019-9154
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023