Description

The system allows the plus character in the email registration process. An attacker could abuse this feature to create several accounts pointing to the same email.

Impact

Create multiple accounts with the same email.

Recommendation

The system must validate emails in such way that an inbox only can be associated or represent an account.

Threat

Anonymous attacker from the Internet.

Expected Remediation Time

⏱️ 60 minutes.

Requirements

Fixes