Summary
The email change form accepts email addresses containing Unicode Mathematical Alphanumeric characters in the local part of the email address without normalization or restriction.
For example, the following email was accepted during testing:
𝕾𝖚𝖕𝖕𝖔𝖗𝖙@aras.nl
Although this address visually appears as Support@aras.nl, the local part uses Unicode homoglyph characters instead of standard ASCII characters. If such addresses are displayed without clear distinction or are used in notifications, logs, account management, or administrative interfaces, they may facilitate impersonation and user confusion.
Affected Endpoint
https:
Payload Used
𝕾𝖚𝖕𝖕𝖔𝖗𝖙@aras.nl
Steps to Reproduce
Log in to your Amplenote account.
Navigate to:
https:
Open the email change form.
Enter the following email:
𝕾𝖚𝖕𝖕𝖔𝖗𝖙@aras.nl
Submit the form.
Observe that the application accepts the Unicode homoglyph email instead of rejecting or normalizing it.
Expected Result
The application should:
Accept only valid ASCII email addresses (unless full EAI/SMTPUTF8 support is intentionally implemented).
Normalize Unicode input where appropriate.
Reject visually confusable Unicode characters in sensitive identity fields.
Warn users when non-standard Unicode characters are detected.
Actual Result
The application accepts an email address containing Unicode Mathematical Alphanumeric characters without validation or normalization.
Security Impact
If Unicode homoglyph emails are accepted throughout the application, attackers may:
Register visually deceptive email addresses.
Impersonate trusted identities such as Support, Admin, or Security.
Mislead users in notifications or account information.
Create confusion for customer support teams and administrators.
Reduce the effectiveness of manual identity verification and auditing.
The overall impact depends on how these email addresses are displayed and used throughout the application.
Business Impact
Increased risk of user impersonation.
Reduced trust in user identity.
Potential phishing or social engineering opportunities within the platform.
Additional workload for customer support due to identity confusion.
Reputational damage if deceptive identities are abused.
Proof of Concept
Endpoint:
https:
Payload:
𝕾𝖚𝖕𝖕𝖔𝖗𝖙@aras.nl
Recommended Remediation
Restrict email addresses to ASCII characters unless internationalized email addresses (EAI/SMTPUTF8) are explicitly supported.
Normalize Unicode input before validation where appropriate.
Detect and reject visually confusable Unicode characters in identity-related fields.
Apply consistent validation across registration, email change, login, and account recovery workflows.
Log and monitor rejected Unicode-based identity attempts for security analysis.
CVSS v3.1 (Suggested)
Score: 5.4 (Medium)
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N