In 2003, Zhao, Varadharajan and Mu proposed a mental poker protocol whose security was shown to be flawed in 2004: any player (or any outsider knowing the deck coding) is able to decrypt encrypted cards without knowing the encryption key. In 2005, the first two authors published a repaired version of this TTP-free mental poker protocol. We show here that this second version is also flawed: the first player can find all cleartexts of the final encrypted shuffled deck of cards. Both protocols are similar to Shamir-Rivest-Adleman?s mental poker, but they replace an exponential commutative cipher with an ElGamal-like commutative cipher. We conclude that changing the underlying commutative cipher is the reason of their weakness.