CVE-2015-8013: s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which al...

Security readout for executives and security teams

OpenPGP.js had a flaw where specially crafted encrypted PGP data could decrypt without the correct passphrase. If an application treated successful decryption as proof of identity, an attacker could bypass that check. The provided sources do not identify affected versions, CVSS severity, or active exploitation. Exposure is most likely in applications using OpenPGP.js for passphrase-protected message decryption, especially where decryption success gates login, access, or authorization. Version-level exposure is not provided in the source bundle. Prioritize review if OpenPGP.js protects access decisions or sensitive message workflows. Business urgency is lower where it is only used for non-authentication cryptographic utilities, but affected versions are not specified in the provided evidence. Mitigation focus: Review OpenPGP.js vendor guidance and the referenced fixing commit.; Upgrade or replace affected OpenPGP.js code according to vendor-maintained release guidance.; Do not use decryption success alone as an authentication control..

Prepared

Jun 12, 2026, 22:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.