TunnelCrack: Leaking VPN Client Traffic by Abusing Routing Tables [pdf]

Looks like many VPNs allow access to the local network. And you can assign public IP ranges to the local network which.. is enough to make clients leak traffic to those IP addresses.

Website with a short explanain: https://tunnelcrack.mathyvanhoef.com