We demonstrate in this Letter that a joint transform correlator shows vulnerability to known-plaintext attacks. An unauthorized user, who intercepts both an object and its encrypted version, can obtain the security key code mask. In this contribution, we conduct a hybrid heuristic attack scheme merge to a Gerchberg-Saxton routine to estimate the encrypting key to decode different ciphertexts encrypted with that same key. We also analyze the success of this attack for different pairs of plaintext-ciphertext used to get the encrypting code. We present simulation results for the decrypting procedure to demonstrate the validity of our analysis. © 2010 Optical Society of America.