#vulns.co
/
mcp by GKData.io

← Back to Gadgets

Email / SMS parser confusion

Canonicalisation bugs between 'is this email taken', 'where do we send the reset', and 'what does the OAuth email claim say'.

Tags: ato, logic, oauth

Typical severity: P2-P4

What it becomes

Register victim@target.com as victim@target.com@attacker.com, or use unicode dots, or plus-tags, depending on what the IdP vs the app vs the mailer treat as the same mailbox.

Where to look

  • register
  • invite
  • SSO linking
  • password reset
  • magic link

Chains

  • ATO / pre-ATO — Create an account the victim later SSO-links, or intercept the reset.

Notes

  • Test the full trio: signup, reset, and OAuth email-claim linking. They often disagree.
  • Do not phish. Use accounts you own.

← Back to Gadgets