IVPN's Eighth Cure53 Audit Checks Unlinked Access

IVPN has published its eighth annual security audit. Cure53 checked Unlinked Access, the system that lets IVPN Plus and Pro Suite accounts use other services without passing on IVPN account identifiers, and IVPN announced the results on 9 November 2026.

We read IVPN’s post and opened the full report on 12 November. Our IVPN review covers the rest of the service and its earlier audits.

What happened

Cure53 spent 10 days on the audit in July 2026 and had access to the source code. IVPN says the work covered four areas:

• the token and pre-authorization services
• the distribution services
• the verifier and the client apps
• the cryptography and privacy model

The auditors found five vulnerabilities, one high, three medium and one low, plus seven general weaknesses. IVPN says “All vulnerabilities were remediated in August 2026.”

IVPN’s post quotes the report’s overall view: “The cryptographic foundation is built on state-of-the-art primitives that are naturally resilient to misuse, while the privacy-preserving unlinked architecture itself is thoughtfully and robustly designed.”

Why it matters

Unlinked Access is a privacy promise. Mailx, IVPN’s email-alias service, modDNS, its DNS filter, and Portmaster should not learn which IVPN customer is using them. An outside review of the code is strong evidence, and the full report shows each finding rather than a summary.

It is not a no-logs audit, though. The work covered the token system, not the VPN servers. IVPN’s only audit of its no-logging claims dates from March 2019, and IVPN has said it will not commission another, as our review explains. Our no-logs explainer compares those dates across providers.

The audit also shows why regular checks matter. A high-severity vulnerability sat in the code until IVPN fixed it in August. IVPN now has eight Cure53 audits since 2019, covering its no-logs claims, its apps, its gateways and its newer services.

What to do

1. Keep the apps updated if you use Mailx, modDNS or Portmaster through IVPN Plus or Pro Suite, so you have IVPN’s latest fixes.
2. Read the report if you want the details of each finding. It is a public PDF, linked above.
3. Compare audit dates if a no-logs audit matters to you, because IVPN’s dates from 2019.
4. Test it within 30 days. IVPN refunds once per account within 30 days, but not cash or voucher payments. Plus costs $8 a month or $80 a year, and Pro Suite $10 or $100.

What we changed

We added the audit to our IVPN data and updated our IVPN review, which said the eighth audit’s results had not been published. IVPN’s score does not change. It already gets full credit for recent security audits, and this one does not cover its no-logs claims.