Zurkhaneh Signup.py: a parser differential in email validation

Zurkhaneh Signup.py is a new hard challenge in the Python game, released for DEF CON 2026. It is a signup portal for company staff only, with a parser differential: two parts of the code read the same email address differently. Your job is to find it and fix it.

The portal checks that an address contains the company domain. The code that registers the account and sends email reads the address by email rules instead, which allow more than name@domain: display names, comments, encoded text and old routing syntax. With those, an address can pass the check and still point to a mailbox outside the company.

The weakness is CWE-179: Incorrect Behavior Order: Early Validation. Any check that approves input in one form while later code reads it in another can be bypassed the same way.

Play it in the Python game: Play - SecDim