# Bypassing the block of Security Domain Restriction and normally invite blocked domains with special characters “İ”

Frontegg domain-restriction deny-list bypassed by using Turkish dotted capital İ in the email domain, letting users invite blocked domains.

- Payout: hidden
- Severity: medium
- Program: Frontegg
- Found by: bugsv2
- Disclosed: 2024-03-20
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2033005
- Library page: https://bugbountylibrary.com/r/h1%3A2033005
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:unicode-normalization vuln:auth-bypass vuln:business-logic

**Target:** User invitation / security domain restriction feature on portal.frontegg.com
**Root cause:** Domain deny-list matching is done on the raw string without Unicode normalization/case-folding, so 'yopmaİl.com' does not match the blocked 'yopmail.com' but the mail system still delivers to the intended domain.
**Steps:**
1. Configure Settings ⇒ Security ⇒ Domain Restrictions ⇒ Deny Only with `yopmail.com`.
2. Go to Settings ⇒ Users ⇒ Invite Users.
3. Invite `email@yopmail.com` → blocked with error.
4. Invite `email@yopmaİl.com` (Turkish dotted capital İ) → invitation succeeds.
5. Invitation email is delivered to the intended recipient.
**How found:** Researcher consulted a Unicode normalization table (0xacb.com/normalization_table) and hypothesized that special characters like İ would evade string-based domain matching.
**Exploitation:** Attacker with invite privileges submits an email whose domain contains the Unicode character İ in place of i; the deny-list check fails to match while the mail delivery resolves to the blocked domain, bypassing the owner's restriction.
**Insight:** When a security control matches on email/domain strings, test Unicode homoglyphs and case-folding variants (e.g. Turkish İ, dotless ı) that normalize to the blocked value downstream but differ at comparison time.