Email Alias Abuse & Rate Limit Bypass via “+” Addressing

linkResolution: ❌

Not a security vulnerability

Not considered for fix

GMail-style email aliases are intentionally allowed


linkReport

Summary
 
The application improperly handles Gmail-style email aliasing using the +operator, allowing attackers to:
 
Create multiple accounts tied to the same underlying email.
 
Bypass invitation rate limits by generating unlimited aliases.
 
Receive all communications (including password resets and invites) in a single inbox.
 
This leads to account duplication, abuse of invite systems, and potential spam or resource exhaustion attacks.
 
Vulnerability Type
Improper Email Normalization
 
Rate Limit Bypass
 
Business Logic Flaw
 
Affected Endpoint
Account Registration
 
Password Reset
 
User Invitation System
 
Steps to Reproduce
1. Account Duplication via Email Alias
Register an account using:
 
aligoodluck427@gmail.com
Register another account using:
 
aligoodluck427+1@gmail.com
Repeat with:
 
aligoodluck427+test@gmail.com
aligoodluck427+abc@gmail.com
Observe:
 
Each is treated as a separate account
 
All emails are delivered to the same inbox
 
2. Password Reset Behavior
Trigger password reset for:
 
aligoodluck427+random@gmail.com
Observe:
 
Reset email is delivered to the main Gmail inbox
 
Confirms alias is not normalized
 
3. Invite Rate Limit Bypass
Attempt to invite the same user multiple times:
 
aligoodluck427@gmail.com blocked after 1 invite
Bypass using aliases:
 
aligoodluck427+1@gmail.com
aligoodluck427+2@gmail.com
aligoodluck427+3@gmail.com
Using automation (e.g., Burp Intruder), send:
 
aligoodluck427+1@gmail.com +100@gmail.com
Observe:
 
Successfully sent 100+ invites
 
All received in the same inbox
 
Impact
Security Impact
Enables mass account creation from a single email
 
Breaks identity uniqueness assumptions
 
Allows invite system abuse
 
Business Impact
Inflated user metrics (fake accounts)
 
Email spam / abuse of notification systems
 
Potential exploitation of referral or reward systems
 
Resource exhaustion (storage, API usage, email sending)
 
Proof of Concept
Created multiple accounts using:
 
aligoodluck427+1@gmail.com
aligoodluck427+2@gmail.com
...
Automated invite sending using Burp Intruder:
 
Generated 100+ unique aliases
 
All emails received in same inbox
 
Rate limit enforced per exact string, not normalized email
 
Root Cause
System does not normalize email addresses
 
Gmail ignores:
 
+anything
 
dots (.) in local part
 
Backend treats aliases as unique users
 
Recommendation
1. Normalize Emails
Strip +tag from Gmail addresses:
 
aligoodluck427+test@gmail.com aligoodluck427@gmail.com
2. Provider-Specific Handling
Apply normalization for:
 
Gmail
 
Outlook (if applicable)
 
3. Strengthen Rate Limiting
Apply limits based on:
 
Normalized email
 
IP address
 
Account ID
 
4. Abuse Detection
Detect patterns like:
 
Multiple accounts with similar prefixes
 
High invite frequency
 
 
Final Note
This issue is particularly impactful because it allows scalable automation of abuse using a single inbox, making detection harder while bypassing intended protections.