According to a third-party report shared on Reddit, ProtonVPN stores authentication private keys in plaintext on user devices. Proton acknowledges this practice as intended behavior rather than a vulnerability. No official advisory or patch information is available. The report does not provide technical details on the implications or mitigations, and there is no evidence of known exploits in the wild.
Impact
Storing authentication private keys in plaintext could potentially expose sensitive credentials if an attacker gains access to the device. However, Proton states this is by design, implying they consider the risk acceptable or mitigated by other controls. No confirmed exploitation or broader impact has been documented.
Defensive guidance
No official patch or remediation guidance is available. Since Proton states this behavior is intended, no immediate action is recommended by the vendor. Users concerned about key exposure should follow best practices for device security and monitor official ProtonVPN communications for updates.