Collected research

Puny-Code, 0-Click Account Takeover

Yashar Shahinzadeh and Amirmohammad Safari · Voorivex · 1 June 2025

Explains how database collation can equate distinct email spellings while message delivery preserves their difference. Reset and OAuth examples map the wrong identity to a victim account; SQL probes, a safe WordPress stored-address counterexample and a testbed distinguish the database comparison from the address ultimately used for delivery.

Record

Researcher

Yashar Shahinzadeh and Amirmohammad Safari

Published by

Voorivex

Date

1 June 2025

Topic

Identity

In the archive

• Collected in the 2025 research round

Related sources

• Punycode Email Identity-Confusion Testbed Code
• Punycode account-takeover practice application

Tags

• unicode
• email
• identity
• auth-bypass
• oauth
• database
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Yashar Shahinzadeh and Amirmohammad Safari, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.