In curl's SASL OAUTHBEARER authentication, including the SOH character (0x01) in the username corrupts the message structure.

This vulnerability arises because curl fails to validate the contents of the username when constructing OAuth2 authentication messages. Depending on the server-side implementation, this could lead to log tampering or credential spoofing.

import socket
import base64

def start_server():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind(('127.0.0.1', 1430)) 
    s.listen(1)
    print("Waiting for IMAP OAuth message on port 1430...")

    while True: …