VPN bypass vulnerability