# HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization

Trailing %0d%0a in signup email bypassed SAML domain enforcement, letting attacker register @hackerone.com account and access PullRequest source code.

- Payout: hidden
- Severity: high
- Program: HackerOne
- Found by: 0xacb
- Disclosed: 2024-02-04
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/2101076
- Library page: https://bugbountylibrary.com/r/h1%3A2101076
- Tags: area:web domain:web impact:ato impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high tech:saml tech:sso technique:parser-differential vuln:access-control vuln:auth-bypass vuln:crlf-injection

**Target:** POST /users signup endpoint and SAML SSO enforcement
**Root cause:** Signup endpoint checks SAML domain enforcement against the raw email string without stripping trailing control characters, so 'email@example.com%0d%0a' fails the domain match and bypasses SSO redirect.
**Steps:**
1. POST /users with `user[email]=email@example.com` returns redirect to `/users/saml/sign_in?email=...`
2. Repeat POST /users with `user[email]=email@example.com%0d%0a` returns `/users/sign_in` with no errors
3. Victim clicks the standard verification email sent to the real address
4. Attacker logs in with chosen password on original session
5. Visit app.pullrequest.com/login and click 'Sign in with HackerOne' to access HackerOne org pull requests
**How found:** Observed that SAML-enforced domains redirect to SSO on signup, then tested appending control characters (%0d%0a) to the email parameter to see if the domain check and the actual account email were parsed differently.
**Exploitation:** Attacker registers an account using a victim-controlled @hackerone.com email with trailing %0d%0a to skip SAML enforcement, waits for the legitimate verification email to be clicked, then logs in and uses 'Sign in with HackerOne' on PullRequest to gain source code access. Pre-staged API keys survive SAML provisioning session revocation.
**Escalation:** Chained signup bypass to PullRequest SSO trust, yielding source code access; also noted API keys persist after SAML account provisioning revokes sessions.
**Insight:** When a signup gate compares a raw email string against an SSO domain list, try appending control characters (%0d%0a, %00, trailing whitespace) so the gate's comparison fails while the stored/normalized email still resolves to the protected domain.