Hysteria's UDP relay implementation contains an authenticated UDP ACL bypass vulnerability. The server applies ACL and outbound policy only once per UDP session at session creation, but later packets within the same session can specify different destinations without re-evaluating ACL rules. This allows an authenticated client to send UDP packets to localhost or private network addresses that should be blocked by ACL, potentially exposing internal UDP services. The issue affects versions from 2.0.0 up to but not including 2.9.2. No patch or official fix is currently documented.