iCloud Private Relay Leaks Real IPs Through Passkey WebAuthn

Security researchers say iCloud Private Relay, Apple’s feature designed to mask IP addresses in Safari, can still reveal a user’s real IP when WebAuthn passkeys are used because the OS credential service issues HTTPS requests outside Private Relay; DNS prefetching and WebTransport may also disclose IPs. Apple is investigating, and a test site has been released by the researchers. Since the leak stems from WebKit behavior and affects some third‑party browsers too, users may want to consider using a VPN or disabling Private Relay for certain sites until a fix is deployed.