[JoseMar]

ExpressVPN Leaked Real IPs During RDP Sessions.
Quiet Fix, Big Implication.

The VPN That Forgot to Hide You

So ExpressVPN had a bug.

A real one, not the vague "minor stability improvements" kind.

If you were using their Windows client and ran Remote Desktop (RDP), there’s a good chance your actual IP address was exposed. Not your masked VPN IP. Your real one. The one you were probably trying to keep private in the first place.

Not great.

Where It All Went Wrong

The issue was caused by leftover debug code. Slipped into production builds. Specifically affected versions from 12.97 up to 12.101.0.2-beta.

What that code did, or more accurately, what it failed to do, was tunnel TCP traffic on port 3389 (the standard port for RDP) through the VPN.

Which means: if you were connected to a remote server using RDP while on ExpressVPN, the traffic just walked around the tunnel. No cloak. No mask. Fully visible IP, right out in the open.

Kind of defeats the whole point, right?

Not Everyone Was Affected, But the Stakes Were High

This wasn't some general leak that hit every user.

If you're just torrenting or browsing with the VPN on, you were probably fine. But if you were doing remote work, server maintenance, anything involving RDP, then yeah, your IP may have been exposed.

And the thing is... people using RDP through a VPN usually care. They’re admins, IT workers, or just cautious users trying to hide where they’re coming from.

This wasn’t a silly bug. It was a privacy fail aimed right at the high-risk crowd.

Reported, Fixed, Still Kinda Scary

To their credit, ExpressVPN responded quickly. A researcher going by Adam-X reported the issue through their bug bounty program. The dev team rolled out a fix in just five days, version 12.101.0.45 patched it.

They even owned it publicly, which you don’t always see.

That said, it's hard not to sit with the weirdness of it. The idea that something this fundamental, like routing traffic securely, can quietly break because of a forgotten line of debug code.

It doesn’t mean ExpressVPN is shady. But it does remind you how fragile these tools can be. How easy it is to trust green checkmarks and connection icons without really knowing what’s happening underneath.

Beyond the Patch: The Bigger Picture

They say the fix came with better safeguards, more automated testing, stricter checks to prevent dev junk from making it into future builds.

Cool. That should help.

But the real lesson here isn’t just "update your VPN client." It’s this nagging little thing in the back of your head: how much do we blindly trust software to be doing what it promises?

VPNs are supposed to be the adult in the room, the privacy tool you count on. When that leaks, it shakes the illusion a bit. And not in a doom-and-gloom way, just... in a quiet, uncomfortable one.

New entry for 7contest🙂
💸 Big shoutout to 6 for making this even more exciting😎

Hey guys, check this out.🙂
DemonAsylum Immortal I ɴ ᴄ ʀ ᴇ ᴅ ɪ ʙ ʟ E itcorp Jen vyactor Dystortion

This wasn’t a breach.

Nobody exploited it. It’s not some earth-shattering scandal.

But it was a real vulnerability, and one that hit users who were probably relying on ExpressVPN the most.

If anything, it’s a reminder that privacy isn’t a switch you flip once. It’s layered, fragile, and sometimes fails in weird, silent ways.

So yeah, update your client. Stay informed. Don’t rely on any tool blindly.

And if you're using RDP with a VPN... maybe take an extra look next time. Just in case.

Anyone else hit by this? Or had similar surprises with other VPNs?
Curious what kind of fails you all have run into over the years.

[ph4ze]

Just gonna ask the dumb question, how was it found out that RDP traffic was moving un-masked? Was it discovered in the wild by a bad actor or just a passersby?

[SpiderSpicy]

Wow this post is piece of art. How impressive job.

[JoseMar]

Wow this post is piece of art. How impressive job.

Appreciate it mate, thank yo. Don´t forget to check out my latest threads 🙂

[SpiderSpicy]

Appreciate it mate, thank yo. Don´t forget to check out my latest threads 🙂

Sure. It will be doable and amaizing.