16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records
A teenage researcher found Microsoft Titan accepted unsigned JWTs, potentially reaching an estimated 17.3 trillion stored rows.
Sixteen-year-old researcher Faav reported an authentication flaw in Microsoft’s internal Titan analytics API. Titan checked JWT claims but did not verify signatures and accepted an unsigned token with algorithm “none” and user “admin,” allowing SQL queries. Counts across 17 ClickHouse databases produced an estimate of about 17.3 trillion stored rows, which Faav said likely included historical, duplicated, and derived data rather than unique people. Faav did not access customer PII, found no evidence of malicious exploitation, and Microsoft disabled the endpoint on September 9, 2026, later paying a $5,000 bounty.
- Faav found Titan accepted unsigned JWTs with algorithm set to none.
- A forged admin token executed SQL against internal ClickHouse analytics.
- The 17.3 trillion row estimate included historical, duplicated, and derived data.
- No customer PII was taken and no malicious exploitation was found.
- Microsoft locked the API on September 9 and paid a $5,000 bounty.
- Vendors
- Microsoft
- Victims
- Microsoft
- Organizations
- MicrosoftMicrosoft Security Response Center
From the original article
3 min read at cybersecuritynews.com
A 16-year-old security researcher known as Faav uncovered an authentication flaw in Microsoft’s internal Titan analytics service that potentially exposed an estimated 17. 3 trillion database rows. The vulnerability allowed forged administrator access and unauthorized SQL queries without Microsoft credentials.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.