MDaemon Mail Server 23.5.2 has a vulnerability in its validation of SPF, DKIM, and DMARC email authentication mechanisms. The server uses the email address enclosed in angle brackets in the From: header for validation. An attacker can exploit this by crafting a From: header containing multiple invisible Unicode thin spaces, allowing the display of a spoofed sender while still passing these anti-spoofing checks. This enables email spoofing despite the presence of SPF, DKIM, and DMARC protections.