Mozilla Accounts

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Core Sites band, the provable band for this asset) │ $5,000 │ $6,000 High (Core Sites band) │ $3,000 │ $3,750 Critical on a site outside the listed scope │ $500 - $1,000 │ $625 - $1,250 Submit a vulnerability CVE history 0 Last 12 months 1 Lifetime Auth bypass 35 % Access control 25 % Info disclosure 20 % XSS 10 % Latest advisories Loading the feed Overview Mozilla Accounts is the single sign-on identity provider behind Firefox Sync, Mozilla VPN, Firefox Relay, Mozilla Monitor and Pocket, covering hundreds of millions of Firefox profiles. It is also one of the very few production-scale, fully open-source OAuth 2.0 and OpenID Connect identity providers whose exact deployed code is public: the instance running at accounts.firefox.com is mozilla/fxa , and Mozilla's own scope entry for the asset ends with the line "Source Code: https://github.com/mozilla/fxa". A public repository, a named production deployment and a paying bounty on the same asset is a rare combination, and it means a reading of the source translates directly into a testable finding. Mozilla pays on the Core Sites band at $3,000 for high and $5,000 for critical, with critical findings on unlisted sites paying $500 to $1,000. sorona.xyz adds 1.25x on top of whatever Mozilla awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~2 hours First response ~4 days Triage ~16 days Bounty In scope Mozilla's HackerOne program lists accounts.firefox.com as a bounty-eligible asset with a maximum severity of critical. Its scope instruction names six further domains underneath it and closes with the line "Source Code: https://github.com/mozilla/fxa" The content server at accounts.firefox.com : registration, login, password reset, account recovery, email verification and two-factor enrolment api.accounts.firefox.com , the auth server API, covering session and key-fetch tokens, the key wrapping that protects synced data, device and session records, recovery keys and account deletion oauth.accounts.firefox.com , the OAuth 2.0 and OpenID Connect surface: authorization and token endpoints, redirect handling, scopes, refresh tokens and relying-party registration profile.accounts.firefox.com and graphql.accounts.firefox.com , the profile and aggregated data layer where account data crosses a boundary verifier.accounts.firefox.com , the assertion verification that decides whether a claimed identity is genuine subscriptions.firefox.com , the FxA-backed subscription platform and the billing authorisation behind it The shared packages in the mozilla/fxa monorepo those services are built from, which is the code Mozilla's own scope instruction points a researcher at Out of scope Mozilla sites and services outside the program's listed assets, which pay only at critical severity and then at $500 to $1,000 HackerOne's core ineligible findings, plus Mozilla's own custom scope exclusions layered on top Bugs in third-party code that has not been incorporated into shipped Mozilla code Aggressive scanning of production rather than testing on the staging instance a scope entry names Reports from anyone who contributed the buggy code, and from Mozilla employees or contractors Lack of clickjacking protection on its own, and XSS that CSP blocks, which Mozilla rates low rather than high Most-valued findings Authentication bypass on the FxA content or auth server that yields a session for an account the reporter does not control, the class carrying the critical band here OAuth or OIDC authorization flaws at oauth.accounts.firefox.com , such as redirect-URI handling or grant confusion that leaks a token to an attacker-controlled relying party Access-control gaps that expose one account's profile, device records or subscription state to another through the API or GraphQL surfaces Weaknesses in key wrapping or session token issuance that undermine the confidentiality of synced data Assertion verification flaws that let a forged identity pass the verifier and be accepted downstream Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Give Mozilla a reasonable amount of time to address the issue before any part of it is shared with a third party Do not run aggressive scanning against production; where a scope entry names a staging instance, testing moves there Reports are not eligible from anyone who contributed the vulnerable code, nor from Mozilla employees and contractors HackerOne's core ineligible findings apply on top of Mozilla's own custom scope exclusions Bugs in third-party code that is not incorporated into shipped Mozilla code are out of scope Severity is judged on real impact: an XSS blocked by CSP is treated as low rather than high, and missing clickjacking protection on its own is not a finding Program stats 372 Reports resolved $451k Bounties paid 86% Response efficiency Disclosure Coordinated through Mozilla on HackerOne under its Gold Standard Safe Harbor policy, with published response targets and an explicit appeal process. Mozilla discloses security reports once they are fixed and rewarded, so your finding becomes public on the program's hacktivity in the normal course; the one obligation is to hold off on sharing it elsewhere until Mozilla has had reasonable time to fix it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability