Meta characters not filtered on signup

How it was found

You have not filtered control meta characters such as %00 etc on the sign up which allows an attacker to impersonate or hide their real identity within the application