• There is a way to verify fake messages, as if they were legitimate
• The error affects multiple versions of OpenPGP.js
• A patch is available

A JavaScript security error implementation of OpenPGP.JS allows threat actors to verify false messages as if they were legitimate, which essentially breaks the public key creepography. These are, according to security researchers Edoardo Geraci and Thomas Rinsma of Codean Labs, who found and recently reported the vulnerability.

OpenPGP.JS is an open source JavaScript library that allows developers to encrypt, decrypt, sign and verify messages using the OpenPGP standard. Usually, when a user signs a message digitally, it ensures that the content was not manipulated.