Bypass auth.email-domains (2)

How it was found

This vulnerability has the same effect as my previously reported bug #2224 Bypass auth.email-domains, but uses a very different approach, bypassing the current fix.

Instead of truncating through length, this vulnerability uses truncation via MySQL’s (weird) behaviour on inserting Unicode characters with code points greater than 0xFFFF into columns that have a utf8 charset. MySQL then truncates a string as soon as it reaches such a character. For more info, see How to support full Unicode in MySQL databases by @mathias.

To replicate, register an account with following address: [email protected]𝌆@allowed-domain.com.

I would suggest to reconsider not verifying email addresses as was mentioned here.