---
title: "Apple iCloud Private Relay flaws leak user IP addresses"  
description: "Yes, websites that use or simulate passkeys can bypass Apple's iCloud Private Relay to view your real IP address."  
author: "Manish Kumar"  
published: 2026-08-05  
updated: 2026-08-05  
canonical: https://www.mindstick.com/news/4825/apple-icloud-private-relay-flaws-leak-user-ip-addresses  
category: "news"  
tags: ["apple", "news", "Tech News"]  
reading_time: 2 minutes  

---

# Apple iCloud Private Relay flaws leak user IP addresses

**Yes, websites that use or simulate passkeys can bypass** [**Apple's iCloud**](https://www.mindstick.com/category/article/iphone) **Private Relay to view your real IP address.**

Security researchers Tommy Mysk and Talal Haj Bakry discovered that when a web page triggers a passkey request via the WebAuthn standard, the process is handled directly by the operating system’s credential service rather than through Safari's standard proxy routing. Because this authentication happens entirely out of band, it creates a direct connection from your device that completely leaks your real IP address to the destination server. Shockingly, this can happen silently in the background without any user interaction or visible prompt as soon as you open an affected page.

## Additional Vulnerability Details

The researchers exposed a total of three distinct features in Apple's WebKit browser engine that actively bypass configuration proxies:

- **WebAuthn Requests**: Fetches validation files straight from the device, exposing your real IP whenever a site supports or simulates passkey logins.
- **DNS Prefetching**: Resolves domain hostnames using your device's normal network path instead of the relay tunnel, exposing your real [DNS server information](https://www.mindstick.com/forum/157376/how-to-work-dns-for-routing-a-website).
- **WebTransport**: Opens direct [HTTP/3 connections](https://www.cloudflare.com/learning/performance/what-is-http3/) that entirely skip application-level proxies to communicate straight with servers.

## Who is Affected?

Because Apple requires all iOS web browsers to utilize the underlying WebKit engine, this issue extends beyond Safari. It actively impacts other proxy-based anonymity clients, including iOS Tor browsers like OnionBrowser.

## How to Protect Yourself

Unlike application-level proxies or iCloud Private Relay, **system-level** [**Virtual Private Networks (VPNs)**](https://www.mindstick.com/articles/44290/virtual-private-network-and-protocols) **are entirely unaffected by this flaw**. Because a traditional VPN encrypts and tunnels all data at the core operating system level, WebKit cannot force an unproxied direct connection outside of it. Running a trusted VPN is currently the most secure way to ensure your real network parameters remain hidden while Apple investigates and prepares a patch.

---

Original Source: https://www.mindstick.com/news/4825/apple-icloud-private-relay-flaws-leak-user-ip-addresses

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.