# Bypass Email verification for monitoring at `monitor.mozilla.org`

Mozilla Monitor's /api/v1/user/breaches leaked email verification tokens, letting an attacker verify and monitor any added email without owner consent.

- Payout: hidden
- Severity: medium
- Program: Mozilla
- Found by: 0d_amrr
- Disclosed: 2025-01-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2712583
- Library page: https://bugbountylibrary.com/r/h1%3A2712583
- Tags: area:web domain:api domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest vuln:auth-bypass vuln:business-logic vuln:info-disclosure

**Target:** monitor.mozilla.org REST API endpoint /api/v1/user/breaches
**Root cause:** The user breaches API returned full records for unverified emails including their email verification tokens, which should never be exposed to the client.
**Steps:**
1. Add a victim email address for monitoring; it requires email verification by the owner
2. Request `GET /api/v1/user/breaches`; response includes unverified emails along with their verification tokens
3. Extract the leaked token
4. Request `GET /api/v1/user/verify-email?token=<verification token>&utm_campaign=verified-subscribers&utm_content=account-verification-email&utm_source=fx-monitor&utm_medium=email`
5. Email is now verified and monitored without owner consent
**How found:** Noticed the breaches API response contained unverified email entries and inspected them, finding verification tokens included in the data.
**Exploitation:** Attacker adds victim emails to their Monitor account, reads the leaked verification tokens from the breaches API, and hits the verify-email endpoint to confirm each address, enabling surveillance of breach exposure for emails they do not own.
**Insight:** When an API returns per-email records, check whether unverified entries carry the same secret tokens used by verification links; verification tokens should be server-side only and never serialized to the client.