Windscribe/Desktop-App v2.23.4

v2.23.4-alpha

on GitHub

Added

• IPv6 connection modes for WireGuard locations that support IPv6.
• OpenVPN DCO support when the ovpn-dco-v2 module is available on Linux.
• Public IP address to windscribe-cli status output, including split tunnel mode.

Improved

• OpenVPN anti-censorship support by replacing the custom junk packet implementation with Amnezia-compatible Junk and I packet options.
• OpenVPN custom config filtering for connection blocks and unsafe custom config paths.
• Proxy Gateway security by blocking proxied connections to localhost, LAN, and link-local destinations, and adding authentication for shared proxy access.
• Custom config directory security checks to run without elevation and correctly detect directories writable by other users.
• Flatpak app split tunneling by matching Flatpak app IDs instead of relying only on executable/command name matching.
• Windows installer handling when the Base Filtering Engine service is stopped, unavailable, or blocked by security software.
• JSON/INI import consistency for proxy sharing and MAC spoofing settings.
• Connection manager connector internals for maintainability without changing connection behavior.
• Dependency build tooling security by using safe YAML config loading.
• Validation for settings.
• Helper file handling and permissions on macOS and Linux.
• Helper reliability when reporting system errors on macOS and Linux.

Fixed

• Possible local privilege escalation in the bootstrapper temporary extraction flow on Windows.
• Possible local privilege escalation in the auto-updater signature verification and launch flow on Windows and macOS.
• VPN sharing proxy relay buffering that could duplicate queued socket data or grow memory usage with slow peers.
• Some OpenVPN custom configs being rejected.
• HTTP Proxy Gateway forwarding proxy authentication credentials to destination websites.
• A possible crash when downgrading from 2.23 to an older version.
• Auth token parse failures logging the raw API response, which could expose session token data in debug logs.
• HTTP Proxy Gateway request parsing allowing unbounded pre-authentication input before authentication challenge.
• Helper IPC frame parsing to reject malformed or oversized messages safely on Windows and Linux.
• Exported preferences not preserving the DNS Manager option on Linux.
• Migration of legacy Flatpak split tunneling entries so existing rules continue to work.
• Generated OpenVPN config files and runtime directories using overly broad permissions that could expose VPN key material to local users on macOS and Linux.
• stunnel/wstunnel relay listeners binding to all interfaces instead of loopback only on macOS and Linux.

Updated

• Qt to 6.11.1.
• OpenVPN to 2.7 with handling for management output changes, Windows DCO/TAP behavior, and Stealth/WStunnel disconnect behavior.
• OpenSSL 4.0.
• WireGuard for Windows to the latest 1.0 release.
• Bundled wstunnel binaries to the latest available release.

GUI Installer Hashes

CLI Installer Hashes