Gmail Address Variants Bypass String Comparison and Enable Multiple Registrations
A developer investigation revealed that one user had successfully registered four separate accounts using only legitimate Gmail address variants that all route to the same mailbox: Ivan.Petrov@gmail.com, ivanpetrov@gmail.com, ivan.petrov+shop@gmail.com, and IVAN.PETROV@gmail.com.
Colleagues noticed more user records than actual people in the database. The discrepancy traced back to a single line of code that compared email addresses as raw strings without normalization.
Gmail treats the local part of an address case-insensitively, discards everything after a plus sign, and ignores dots. These rules let one inbox generate an unlimited number of distinct strings that still receive mail at the same destination.
Why string comparison fails
Three common cases break naive equality checks:
- Case differences in the local part or domain
- Plus-addressing suffixes such as +shop or +promo
- Dots inserted anywhere in the local part of a Gmail address
Normalization must be applied selectively. Dots are ignored only for gmail.com and googlemail.com; applying the same rule to other providers would incorrectly merge unrelated mailboxes.
Homograph domain attacks
A separate but related threat appears when domains contain visually identical Cyrillic characters. The string еxample.ru (with Cyrillic е) encodes under IDNA to xn--xample-2of.ru, creating a look-alike address that passes superficial inspection yet points elsewhere.
Recommended implementation
Store two fields: the original address for sending mail and a normalized address for uniqueness enforcement. Perform lower-casing on the entire address, strip plus-suffixes only for Gmail, remove dots only for Gmail, and run every submitted domain through IDNA encoding to detect hidden non-ASCII labels. A simple confirmation email remains the most reliable validator of deliverability.
A diagnostic query can surface existing problems by grouping on the normalized domain and comparing raw versus deduplicated local parts.
Related articles
ServiceNow AI Platform Affected by Five Vulnerabilities Including Critical SQL Injection Flaws
ServiceNow disclosed five vulnerabilities in its AI Platform on September 24, 2026, through a security advisory. Two of the issues received CVSS v4.0 base scores of 9.3 and were rated Critical. CVE-2026-13016 allows unauthenticated remote attackers to perform SQL injection and manipulate database contents under specific conditions. CVE-2026-86860 stems from improper authorization checks that enable data exfiltration and privilege escalation without authentication. The flaws were identified via internal testing, coordinated disclosure, and the company's bug bounty program. ServiceNow urges customers to apply the provided updates immediately to mitigate the risks.
CISA Adds Adobe Commerce and WSO2 Vulnerabilities to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-71362 affects Adobe Commerce and Magento, enabling attackers to escalate privileges through an authorization bypass flaw. CVE-2026-5430 impacts multiple WSO2 API management products and allows JWT authentication bypass, leading to administrator account takeover and remote code execution via arbitrary file uploads. Adobe issued an advisory in August 2026 recommending patches within 30 days, while WSO2 warned about the issue in May 2026. CISA has set a September 27, 2026 deadline for federal agencies to apply updates and investigate potential compromises.
Blackbox Asset Management: Discovering and Identifying IT Infrastructure Without Direct Access
Security Vision expert Fedor Bokov explains how organizations can manage IT assets in blackbox mode when customers refuse to provide credentials or internal documentation. The approach begins with network scanning using tools such as nmap and masscan to detect live hosts and open ports across external and internal perimeters. Identification relies on banner grabbing, HTTP header analysis, favicon inspection, HTML structure, and service fingerprinting to determine exact software versions and operating systems. Examples include extracting Ubuntu 22.04 LTS details from an OpenSSH banner and identifying Checkpoint Gaia from specific HTTP responses on port 443. Further analysis of ports like 1433 and 443 reveals Microsoft SQL Server 2017, nginx 1.28.0, PHP 8.2.29, and Bitrix-Site-Manager instances. The methodology concludes with continuous monitoring cycles that track version changes, new services, and configuration deviations to prioritize vulnerability remediation without traditional inventory access.
Check Point Patches Critical Zero-Day CVE-2026-93616 Enabling Unauthenticated Remote Code Execution on Management Servers
Check Point has addressed a critical zero-day vulnerability tracked as CVE-2026-93616 with a CVSS score of 9.8 that allowed remote unauthenticated attackers to upload and execute arbitrary scripts on management servers. The flaw combined directory traversal with insecure file handling, enabling attackers to escape the intended directory and place scripts in executable locations. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Targeted attacks were observed starting July 23 before public disclosure, though exploitation remained limited. Vulnerable versions span multiple R82, R81, and R80 releases, with fixes now available through specific hotfixes and Jumbo Takes. Administrators are advised to apply patches immediately, place management servers behind a Security Gateway, and restrict TCP port 19009 access. Detection guidance includes reviewing cpm.elg logs for unusually long usernames and ReflectionUtils errors containing directory traversal sequences.