Creative usernames and Spotify account hijacking
This seems odd.  I mean, if their code was properly modular, they would have just one place where they "fetchUserIdByName(userName)", which returns one user ID or null if it's not used yet.When a new user is created, it then gets assigned a unique user ID.   The email address is assigned to that user ID.Then, if they do a password reset on user = "bigbird", it should do the exact same lookup to find the email address.The security bug was not really about having an improper function to do unicode translation.  It was more about having different functions for the same check, simply because they were in different parts of the code.Modular code is just so much better on all fronts, including security.