Email / SMS parser confusion
Canonicalisation bugs between 'is this email taken', 'where do we send the reset', and 'what does the OAuth email claim say'.
Tags: ato, logic, oauth
Typical severity: P2-P4
What it becomes
Register victim@target.com as victim@target.com@attacker.com, or use unicode dots, or plus-tags, depending on what the IdP vs the app vs the mailer treat as the same mailbox.
Where to look
registerinviteSSO linkingpassword resetmagic link
Chains
- ATO / pre-ATO — Create an account the victim later SSO-links, or intercept the reset.
Notes
- Test the full trio: signup, reset, and OAuth email-claim linking. They often disagree.
- Do not phish. Use accounts you own.