Windscribe/Desktop-App v2.23.11

on GitHub

Added

• Package signing and update authenticity hardening for supported Linux packages.

Improved

• App hardening from the Fable 5 audit, including WireGuard key validation, Control D API key log redaction, IPC exposure hardening, safer logging, installer argument redaction, and package/dependency handling fixes.
• Windows helper IPC parameter validation to reduce local IPC attack surface.
• Linux helper IPC/API hardening after EGL gid-check bypass review.
• Windows IKEv2 connector stability to mitigate possible crashes.
• macOS builds against Xcode 26.5 and enabled ARC for client-common Objective-C++ code.
• Proxy Gateway privacy by no longer logging blocked destinations for HTTP and SOCKS gateway requests.
• IP Stack preference wording to clarify it applies to WireGuard only.
• Preferences title casing consistency.
• Sign Up screen helper text styling under the Password and Email fields.
• JSON/INI import consistency for proxy sharing and MAC spoofing settings.
• Debug logs by removing false positives that could mislead automated log analysis on Windows.
• Russian and Ukrainian translations in the desktop app, installer, and CLI from GitHub user WkdXeqtr.
• Belarusian translations in the desktop app, installer, and CLI from GitHub user dubovy-achvelak.

Fixed

• DLL planting vulnerability in the Windows bootstrapper and uninstaller.
• Windows installer/updater staging TOCTOU allowing the privileged helper to copy from a different source path than the one it validated.
• Local privilege escalation security vulnerability from app retaining SETGID capability after group switch on Linux.
• Possible local privilege escalation chain involving external-link opening and OpenVPN directive validation bypass.
• OpenVPN custom config filtering to handle embedded NULL/control characters consistently and reject unsafe directives.
• OpenVPN custom config parsing to prevent commented-out route-nopull / route-noexec text from disabling automatic firewall handling.
• Malformed OpenVPN inline tags bypassing custom config directive filtering.
• AmneziaWG custom WireGuard I-values allowing newline/config injection in imported custom configs.
• Custom OpenVPN device names that could bypass Linux DNS leak protection by using wildcard-style interface names.
• Split tunneling service startup failures not showing the expected user-facing warning prompt on Windows.
• A crash when clicking the menu bar icon on affected macOS 27 beta builds.
• DNS leak protection allowing pre-VPN OS DNS resolvers when DNS traffic egressed over the VPN interface on Linux.
• Always On+ firewall feature eventually showing the Ignore SSL errors prompt during blocked or delayed connectivity.
• Launch on startup mechanism may fail to apply during a reboot.
• Control D via API Key connections failing when an IPv6 bootstrap IP from Custom DNS was retained without native IPv6.
• Ignore SSL Errors runtime bypass handling to reset wsnet failovers before retrying failed requests.
• IP pinning fallback when an Advanced Parameters remote IP does not match the selected location.
• Memory leak when handling CLI IPC commands.
• Windows installer progress handling near completion when uninstalling previous components and launching the app.
• Periodic reconnects on Windows IKEv2 connections caused by transient OS status checks.
• Logout/session deletion leaving the Windscribe IKEv2 VPN profile in macOS System Settings.
• Linux address selection so IPv6-capable VPN connections do not incorrectly prefer IPv4 via Windscribe gai.conf handling.
• deb/rpm packages installing scripts or helper files with world-writable permissions.
• Data-remaining counter showing 0 bytes after an expired/blocked account state and newly logged into account has remaining data.
• Networks marked Unsecured being treated as Secured on launch, which could incorrectly trigger auto-connect.
• Imported dashed MAC spoof values showing incorrectly and reporting MAC spoofing failure even though the spoof was applied.
• IKEv2 inclusive split tunneling leaving a low-metric default tunnel route active, causing non-included traffic to route through the VPN on Windows.
• Linux IPv6 split-tunnel routes being added without the required interface name.
• Linux IPv6 DNS leak protection missing ip6tables rules for IPv6 DNS resolvers.
• Linux split-tunneling process monitor skipping proc events after the first netlink read.
• Linux split-tunneling setup failures being reported as successful.
• Persistent Ignore SSL Errors preference behavior so TLS validation bypass is runtime-only and does not survive app restart.
• Connected DNS Custom 0.0.0.0 breaking local ctrld resolver behavior while connected.
• Split tunneling disabled message handling on macOS.

Updated

• Updated wsnet to 1.5.20.

Removed

• The Contact Humans preference from the help UI.

GUI Installer Hashes

CLI Installer Hashes