diff --git a/proxy/vmess/vmess.go b/proxy/vmess/vmess.go
index 6d5510ade..20bd83b54 100644
--- a/proxy/vmess/vmess.go
+++ b/proxy/vmess/vmess.go
@@ -64,7 +64,11 @@ func (v *TimedUserValidator) generateNewHashes(nowSec protocol.Timestamp, user *
 	var hashValue [16]byte
 	genHashForID := func(id *protocol.ID) {
 		idHash := v.hasher(id.Bytes())
-		for ts := user.lastSec; ts <= nowSec; ts++ {
+		lastSec := user.lastSec
+		if lastSec < nowSec-cacheDurationSec*2 {
+			lastSec = nowSec - cacheDurationSec*2
+		}
+		for ts := lastSec; ts <= nowSec; ts++ {
 			common.Must2(idHash.Write(ts.Bytes(nil)))
 			idHash.Sum(hashValue[:0])
 			idHash.Reset()