This is what I thought at first. If it's the exact same check (which it should be), why is there any possibility of the answer being different? But the real "bu

This is what I thought at first. If it's the exact same check (which it should be), why is there any possibility of the answer being different? But the real "bug" here is that they were treating the canonicalized username as if it were just as good as the original username, which is only true if the adjustment function is idempotent as they say. Another possible solution would be to assume the username given to the password reset form is already canonicalized (which would be necessarily true, as far as I understand). EDIT: However this wouldn't solve the other bug that's been discovered here, which is that "ᴮᴵᴳᴮᴵᴿᴰ" is canonicalized differently than "BIGBIRD", thus defeating the purpose of canonicalization (for that particular case) in the first place.