A security issue has been found in OpenVPN before 2.4.9, where a 'peer-id' check is not performed correctly during a small amount of time after a connection has been established. A rogue client sending a data channel packet during that time, from a different source address and with the same 'peer-id', would cause the client data to float to that new address, effectively sopping the VPN traffic of the first, legitimate client.
A security issue has been found in OpenVPN before 2.4.9, where a 'peer-id' check is not performed correctly during a small amount of time after a connection has been established. A rogue client sending a data channel packet during that time, from a different source address and with the same 'peer-id', would cause the client data to float to that new address, effectively sopping the VPN traffic of the first, legitimate client.
https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae76225ab https://community.openvpn.net/openvpn/ticket/1272
Vulmon