CVE-2023-27043

Python's email module incorrectly parses certain email addresses with special characters, which can allow attackers to bypass domain-based email verification checks. An attacker could register or gain access using a forged email address that appears valid but isn't actually from the allowed domain.

The email parser in Python's email/_parseaddr.py mishandles RFC2822 headers containing special characters, causing incorrect extraction of the addr-spec portion. This enables authentication bypass attacks where domain-based email filters (e.g., requiring @company.example.com) can be circumvented by crafting malformed email addresses that parse incorrectly, granting unauthorized access when the application relies on naive email validation.