16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records
A teenage researcher found Microsoft Titan accepted unsigned JWTs, potentially reaching an estimated 17.3 trillion stored rows.
Sixteen-year-old researcher Faav reported an authentication flaw in Microsoft’s internal Titan analytics API. Titan checked JWT claims but did not verify signatures and accepted an unsigned token with algorithm “none” and user “admin,” allowing SQL queries. Counts across 17 ClickHouse databases produced an estimate of about 17.3 trillion stored rows, which Faav said likely included historical, duplicated, and derived data rather than unique people. Faav did not access customer PII, found no evidence of malicious exploitation, and Microsoft disabled the endpoint on September 9, 2026, later paying a $5,000 bounty.
- Faav found Titan accepted unsigned JWTs with algorithm set to none.
- A forged admin token executed SQL against internal ClickHouse analytics.
- The 17.3 trillion row estimate included historical, duplicated, and derived data.
- No customer PII was taken and no malicious exploitation was found.
- Microsoft locked the API on September 9 and paid a $5,000 bounty.
Full article630 words · extracted from cybersecuritynews.com · click to collapse
A 16-year-old security researcher known as Faav uncovered an authentication flaw in Microsoft’s internal Titan analytics service that potentially exposed an estimated 17.3 trillion database rows.
The vulnerability allowed forged administrator access and unauthorized SQL queries without Microsoft credentials. However, Faav emphasized that the potential impact was hypothetical.
The researcher relied on metadata, table descriptions, and limited samples, never accessing customer personally identifiable information (PII), and found no evidence that malicious actors exploited this weakness.
The investigation began on August 25, 2026, when Faav’s AI-powered hacking assistant, Antares, discovered Titan. Although the web interface displayed a “VPN REQUIRED” page, Antares identified a public API hosted through Azure Cloud Services.
An exposed Swagger document listed four routes, including /v2/Query, which accepted raw SQL. Archived 2023 Titan pages also revealed 56 table definitions and a routing value named TestData, giving the researcher enough information to begin controlled testing.
Requests without an authorization header correctly returned HTTP 401. Yet over the following ten days, Antares altered JSON Web Token claims and studied Titan’s error messages.
Microsoft’s Internal Titan Analytics Vulnerability
The service checked the tenant ID, audience, application ID, and user identity, but continued processing modified claims while the original signature remained unchanged. That behavior indicated a failure: Titan examined what the JWT asserted without cryptographically confirming who issued it.
Faav then created a synthetic token with its algorithm set to “none” and an empty signature. Titan accepted it. The payload needed a recognized user, and automated attempts using email-formatted User Principal Names failed.
The breakthrough came after Faav reconsidered how the backend might interpret the upn field and replaced it with “admin.” Titan mapped the value to local user ID 1, assigned the Admin role, and successfully executed a SELECT 1 query.
Limited exploration exposed Titan’s platform metadata database and other connected analytics environments. Accessible metadata reportedly included approximately 25,000 account and email records, 17,990 employee email entries, 15,001 employee organization records, 355 database configurations, 20,979 virtual-dataset SQL definitions, 24,569 dashboards, 425,891 charts, and 27,347 dataset definitions.
Two restricted one-row queries additionally confirmed that Bing search analytics were reachable. Faav said no individuals were identified and no records were linked across datasets.
To estimate the exposure, the researcher tested all 56 archived routing values using SELECT 1; 30 remained active. Those routes resolved through 24 configurations to 17 ClickHouse analytics databases covering 9,863 unique table names. Row totals were calculated through both system.tables.total_rows and active system.parts, producing the estimate: 17,333,335,124,315 rows.
Faav cautioned that this storage figure likely included historical, duplicated, and derived records, meaning it should not be interpreted as 17.3 trillion unique people or exposed customer records.
Faav reported the vulnerability to the Microsoft Security Response Center on September 5, opening case 144051. Microsoft locked down the API endpoint on September 9, awarded the researcher a $5,000 bounty on September 17, and coordinated publication. The company thanked Faav for responsible disclosure and said the report helped it harden services and better protect customers.
The finding demonstrates why claim validation alone cannot secure JWT-based authentication. Applications must cryptographically verify every token signature, reject unsigned tokens, restrict approved algorithms, validate issuer and audience values, and avoid mapping attacker-controlled claims directly to privileged local accounts.
In Titan’s case, one missing signature check neutralized several otherwise functioning access-control layers—and turned a public analytics endpoint into a potential gateway to an enormous Microsoft data environment.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.