We've recently fixed several issues which allowed an attacker to bypass the auth.email-domains setting and register an account without controlling a valid email address.

You are vulnerable if: you have at least one registration-enabled auth provider which an attacker could register an account on (like email, Google, or Facebook, but usually not LDAP); you rely on auth.email-domains to restrict registrations; and you have disabled the administrative approval queue.

Even if you are not vulnerable, the fixes for these issues harden Phabricator against attacks of this class, and all installs are advised to upgrade.

If you don't want to upgrade immediately, a workaround is to enable the approval queue (auth.require-approval) and manually approve registrations until you have a chance to upgrade.