PureVPN Vulnerability Reveals IPv6 Address While Reconnecting to Wi-Fi

A security vulnerability has been identified in PureVPN’s Linux clients, affecting both the GUI (version 2.10.0) and the CLI (version 2.0.1) on Ubuntu 24.04.3 LTS, which can reveal users’ real IPv6 addresses during network reconnections. The primary issue occurs when users toggle Wi‑Fi connections or resume from suspend, as the client fails to maintain proper IPv6 protections, allowing IPv6 traffic to bypass the VPN tunnel.

In CLI mode with Internet Kill Switch enabled, the client reconnects and reports a “connected” status, but a default IPv6 route is re-established via Router Advertisements, leaving traffic unprotected. The GUI scenario is worse still, since IPv6 continues to operate even after a disconnection is detected and the VPN session is shown as disconnected until the user clicks Reconnect, creating a substantial window of vulnerability.

On top of the IPv6 leakage, the connection process wipes the user’s iptables configuration, setting INPUT policies to ACCEPT and flushing rules including UFW protections, Docker jump rules, and other user-defined security policies, with no automatic reversion on disconnect. The vulnerability was reported by a security researcher through PureVPN’s Vulnerability Disclosure Program in late August 2025, and PureVPN has not acknowledged the issue three weeks after the initial disclosure.