How it works
What your VPN client leaks locally (2026 findings)
People pick a client for speed and convenience. But a client is a program running on your device with every packet passing through it, and it carries an attack surface of its own — one that has nothing to do with how good the tunnel is. In 2026 that stopped being theoretical: a researcher went through the popular Xray-based clients and found problems in several at once.
What was actually found
On 10 March 2026 the researcher notified the developers of every popular client. By 7 April, when the write-up went public, not one of them had shipped a fix. The affected family is the Xray-core clients — Happ, V2RayTun, Hiddify, v2rayNG. They share a core, so they share weak spots.
An open control interface — the serious one
Happ shipped with the Xray control interface (HandlerService) enabled and unauthenticated. In practice that meant any other app on the same device could query it and dump the configuration: keys, server address, the cover domain name. That is not metadata — that is your access to the service.
Happ closed it on 11 April 2026 and was the first client to do so. If you have updated since April, this particular hole is gone from your install.
The unauthenticated local proxy — still open
The second finding is subtler and, as of August 2026, still current. The client runs a local SOCKS proxy on 127.0.0.1 with no password on it. Any other program on the device can route a request through that proxy and learn which external address the network sees. The tunnel itself holds, but for an application installed specifically for privacy, having the exit address readable from inside the device is an awkward gap.
What to do about it
- Update the client. Most of what was found is fixed, but only in recent builds — an old build stays vulnerable forever.
- Install only from the developer's official page or an app store. Repackaged builds from third-party sources are a much larger risk than anything described here.
- Do not keep the client on the same device as apps from sources you do not trust: these issues are exploited from inside the system.
- Treat the subscription key as a credential. If you think it could have been read, reissue it rather than hoping it was never used.
Checking your own build
- 1Open the client's About screen and note the version and build date.
- 2Compare it against the current release on the developer's official page.
- 3If your build predates April 2026, update — that closes the main finding.
- 4After updating, re-import your subscription so the client picks up current connection parameters.
To confirm what actually leaves your machine, see what your ISP can see. If you are still choosing an app, the trade-offs are laid out in choosing a VPN client.
Does this mean Happ is unsafe?
No. It was the first client to fix the main finding, which says more about active maintenance than about weakness. The remaining local proxy issue is shared across the family, not specific to Happ.
Could someone have stolen my subscription over the internet?
No. Both findings require code running on the same device as the client. Neither enables a remote attack.
Should I switch clients?
Switching does not address it by itself — the findings concern the shared Xray core rather than one app. Keeping the build current and avoiding untrusted software matters more.
How would I know if my key was compromised?
There is no reliable local indicator. That is exactly why reissuing is the cheap move: the old key stops working immediately and the new one imports in under a minute.
Did this help?
Nothing follows from the answer; only we see it.