diff --git a/pkg/server/auth/saml_check_sso_handler.go b/pkg/server/auth/saml_check_sso_handler.go
index c8e940b6e..0a08bd4b5 100644
--- a/pkg/server/auth/saml_check_sso_handler.go
+++ b/pkg/server/auth/saml_check_sso_handler.go
@@ -18,6 +18,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/mail"
 
 	authsvc "github.com/getprobo/probo/pkg/auth"
 	"go.gearno.de/kit/httpserver"
@@ -52,6 +53,11 @@ func SAMLCheckSSOHandler(authSvc *authsvc.Service, logger *log.Logger) http.Hand
 			return
 		}
 
+		if _, err := mail.ParseAddress(req.Email); err != nil {
+			httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("invalid email format"))
+			return
+		}
+
 		configs, err := authSvc.CheckSSOAvailabilityByEmail(ctx, req.Email)
 		if err != nil {
 			logger.ErrorCtx(ctx, "cannot check SSO availability", log.Error(err))