This is a cool business logic flaw. While hunting on the xyz website, I discovered that users could bypass the email-uniqueness restriction during account creation by manipulating email formatting (for example, using dots or character addressing).

Here is the flow:

Page 1: Registration >> Unwhitelisted email (Blocked) >> Whitelisted email (Accepted)

Page 2: Resend token/email not received >> Modify to Unwhitelisted email (Accepted)

The system initially prevent creating accounts with similar email format but then on another tab, users could trigger the “email not received”, then modify the email to the unwhitelisted email format to receive a confirmation email.

The impact was how users could bypass the initialy restriction on the account creation page on the not received email page.

Tips:

Bug bounties require patience and a careful understanding of how an application works. Always check for inconsistent validation or normalization across different endpoints.

Feel Free to connect with me on LinkedIn or X :

https://www.linkedin.com/in/umanhonlen/

https://x.com/sudosu01

Thank you!