Lab: Bypassing access controls using email address parsing discrepancies
Summary: PortSwigger's lab demonstrates an email address parsing discrepancy in which a registration form enforces a ginandjuice.shop domain check, but encoded-word formats slip past it: UTF-8 and ISO-8859-1 encoded addresses were blocked with 'Registration blocked for security reasons,' while a UTF-7 encoded address was not. By encoding the @ symbol and a space in UTF-7, the address passes validation on its trailing @ginandjuice.shop portion while the email server interprets it as attacker@[exploit-server], letting the solver confirm the account and delete the carlos user.
What's compelling: The control failed not because the domain check was missing but because two parsers read the same string differently - the validator saw ginandjuice.shop, the mail server saw the attacker's domain, and only the UTF-7 variant got through. Any access control that validates an identifier in one component and acts on it in another inherits that gap.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026