Summary
The application improperly handles Gmail-style email aliasing using the “+” operator, allowing attackers to:
Create multiple accounts tied to the same underlying email.
Bypass invitation rate limits by generating unlimited aliases.
Receive all communications (including password resets and invites) in a single inbox.
This leads to account duplication, abuse of invite systems, and potential spam or resource exhaustion attacks.
Vulnerability Type
Improper Email Normalization
Rate Limit Bypass
Business Logic Flaw
Affected Endpoint
Account Registration
Password Reset
User Invitation System
Steps to Reproduce
1. Account Duplication via Email Alias
Register an account using:
aligoodluck427@gmail.com
Register another account using:
aligoodluck427+1@gmail.com
Repeat with:
aligoodluck427+test@gmail.com
aligoodluck427+abc@gmail.com
Observe:
Each is treated as a separate account
All emails are delivered to the same inbox
2. Password Reset Behavior
Trigger password reset for:
aligoodluck427+random@gmail.com
Observe:
Reset email is delivered to the main Gmail inbox
Confirms alias is not normalized
3. Invite Rate Limit Bypass
Attempt to invite the same user multiple times:
aligoodluck427@gmail.com → blocked after 1 invite
Bypass using aliases:
aligoodluck427+1@gmail.com
aligoodluck427+2@gmail.com
aligoodluck427+3@gmail.com
Using automation (e.g., Burp Intruder), send:
aligoodluck427+1@gmail.com → +100@gmail.com
Observe:
Successfully sent 100+ invites
All received in the same inbox
Impact
Security Impact
Enables mass account creation from a single email
Breaks identity uniqueness assumptions
Allows invite system abuse
Business Impact
Inflated user metrics (fake accounts)
Email spam / abuse of notification systems
Potential exploitation of referral or reward systems
Resource exhaustion (storage, API usage, email sending)
Proof of Concept
Created multiple accounts using:
aligoodluck427+1@gmail.com
aligoodluck427+2@gmail.com
...
Automated invite sending using Burp Intruder:
Generated 100+ unique aliases
All emails received in same inbox
Rate limit enforced per exact string, not normalized email
Root Cause
System does not normalize email addresses
Gmail ignores:
+anything
dots (.) in local part
Backend treats aliases as unique users
Recommendation
1. Normalize Emails
Strip +tag from Gmail addresses:
aligoodluck427+test@gmail.com → aligoodluck427@gmail.com
2. Provider-Specific Handling
Apply normalization for:
Gmail
Outlook (if applicable)
3. Strengthen Rate Limiting
Apply limits based on:
Normalized email
IP address
Account ID
4. Abuse Detection
Detect patterns like:
Multiple accounts with similar prefixes
High invite frequency
Final Note
This issue is particularly impactful because it allows scalable automation of abuse using a single inbox, making detection harder while bypassing intended protections.