Had Claude trace how the submitted email reaches the MailboxValidator API and what happens on failure, and found two things that combine into a full bypass.
First, every API call builds its URL like this, with no urlencode():
$url = 'https://api.mailboxvalidator.com/v2/validation/single?key=' . str_replace(' ','',$api_key) . '&email=' . str_replace(' ','',$emailAddress) . '&source=phpbb';& is a valid character in an email's local part (RFC 5322 permits it unquoted), so a registrant can submit something like evil&key=x@example.com and inject an extra query parameter into the real API request, or in some server-side parsers, override the site's own key= value.
Second, every failure path in event/main_listener.php fails open: phpbb_mbv_single() returns true (valid) on any exception or empty response, phpbb_mbv_is_valid_email() returns true if the API response contains an error key, and phpbb_mbv_is_free()/phpbb_mbv_is_disposable() return false (meaning "not free"/"not disposable") in the same situation.
Put together: anyone who wants to register with a disposable or free email just needs an & in the local part to corrupt the outbound API call into an error response, and the fail-open logic lets the registration through, defeating the extension's entire purpose for anyone who tries.
A fix needs both pieces: urlencode() the email and API key before building the URL, and decide deliberately whether validation failures should block registration (fail closed, safer default, with a clear error message) or only skip the specific check that failed rather than treating a broken request as "valid."
Had Claude trace how the submitted email reaches the MailboxValidator API and what happens on failure, and found two things that combine into a full bypass.
First, every API call builds its URL like this, with no
urlencode():&is a valid character in an email's local part (RFC 5322 permits it unquoted), so a registrant can submit something likeevil&key=x@example.comand inject an extra query parameter into the real API request, or in some server-side parsers, override the site's ownkey=value.Second, every failure path in
event/main_listener.phpfails open:phpbb_mbv_single()returnstrue(valid) on any exception or empty response,phpbb_mbv_is_valid_email()returnstrueif the API response contains anerrorkey, andphpbb_mbv_is_free()/phpbb_mbv_is_disposable()returnfalse(meaning "not free"/"not disposable") in the same situation.Put together: anyone who wants to register with a disposable or free email just needs an
&in the local part to corrupt the outbound API call into an error response, and the fail-open logic lets the registration through, defeating the extension's entire purpose for anyone who tries.A fix needs both pieces:
urlencode()the email and API key before building the URL, and decide deliberately whether validation failures should block registration (fail closed, safer default, with a clear error message) or only skip the specific check that failed rather than treating a broken request as "valid."