Hysteria's UDP relay treats destination addresses as packet-scoped, but ACL and outbound authorization are applied only once at session creation. An authenticated client can open a UDP session with an allowed first destination, then reuse the same session to send packets to destinations that ACL should reject, such as localhost (127.0.0.1) or RFC1918 private network addresses. This bypasses server-side UDP ACL rules, breaking the intended UDP egress restrictions. The vulnerability was verified on the current HEAD at commit 64c396385631579598cc29d5561bff98c439772f and affects versions >=2.0.0 <2.9.2. The root cause is that authorization is session-scoped while destination selection is packet-scoped, allowing later packets to bypass ACL checks.

Authenticated users allowed to use the UDP relay can bypass ACL restrictions to reach internal UDP services on localhost or private network addresses from the server's perspective. This can expose sensitive internal services such as DNS resolvers, service discovery endpoints, telemetry listeners, local administrative daemons, and application-specific UDP services intended to be accessible only internally. The ACL-based UDP egress security boundary is effectively broken for these users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, operators should be aware that ACL rules may be bypassed for UDP destinations within the same session. Consider restricting authenticated UDP relay usage to trusted clients only or disabling UDP relay if internal UDP services must be protected. Monitor vendor channels for updates and patches addressing this issue.