This was originally reported as a private security issue, but has been approved for handling in the public queue by the Drupal Security Team.

Background information

Problem/Motivation

Similar letters from other alphabets can be used to bypass username restrictions.
For example if the module is configured to disallow the "admin", it is still possible to use a Cyrillic A instead (аdmin).

There is also a core issue about this: #85826: Prevent homographic usernames

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Comments

prudloff created an issue.