A 16-year-old security researcher known as Faav uncovered an authentication flaw in Microsoft’s internal Titan analytics service that potentially exposed an estimated 17.3 trillion database rows.

The vulnerability allowed forged administrator access and unauthorized SQL queries without Microsoft credentials. However, Faav emphasized that the potential impact was hypothetical.

The researcher relied on metadata, table descriptions, and limited samples, never accessing customer personally identifiable information (PII), and found no evidence that malicious actors exploited this weakness.

The investigation began on August 25, 2026, when Faav’s AI-powered hacking assistant, Antares, discovered Titan. Although the web interface displayed a “VPN REQUIRED” page, Antares identified a public API hosted through Azure Cloud Services.

An exposed Swagger document listed four routes, including /v2/Query, which accepted raw SQL. Archived 2023 Titan pages also revealed 56 table definitions and a routing value named TestData, giving the researcher enough information to begin controlled testing.

Requests without an authorization header correctly returned HTTP 401. Yet over the following ten days, Antares altered JSON Web Token claims and studied Titan’s error messages.

Microsoft’s Titan Analytics Vulnerability

The service checked the tenant ID, audience, application ID, and user identity, but continued processing modified claims while the original signature remained unchanged. That behavior indicated a failure: Titan examined what the JWT asserted without cryptographically confirming who issued it.

Faav then created a synthetic token with its algorithm set to “none” and an empty signature. Titan accepted it. The payload needed a recognized user, and automated attempts using email-formatted User Principal Names failed.

The breakthrough came after Faav reconsidered how the backend might interpret the upn field and replaced it with “admin.” Titan mapped the value to local user ID 1, assigned the Admin role, and successfully executed a SELECT 1 query.

Limited exploration exposed Titan’s platform metadata database and other connected analytics environments. Accessible metadata reportedly included approximately 25,000 account and email records, 17,990 employee email entries, 15,001 employee organization records, 355 database configurations, 20,979 virtual-dataset SQL definitions, 24,569 dashboards, 425,891 charts, and 27,347 dataset definitions.

Two restricted one-row queries additionally confirmed that Bing search analytics were reachable. Faav said no individuals were identified and no records were linked across datasets.

To estimate the exposure, the researcher tested all 56 archived routing values using SELECT 1; 30 remained active. Those routes resolved through 24 configurations to 17 ClickHouse analytics databases covering 9,863 unique table names. Row totals were calculated through both system.tables.total_rows and active system.parts, producing the estimate: 17,333,335,124,315 rows.

Faav cautioned that this storage figure likely included historical, duplicated, and derived records, meaning it should not be interpreted as 17.3 trillion unique people or exposed customer records.

Faav reported the vulnerability to the Microsoft Security Response Center on September 5, opening case 144051. Microsoft locked down the API endpoint on September 9, awarded the researcher a $5,000 bounty on September 17, and coordinated publication. The company thanked Faav for responsible disclosure and said the report helped it harden services and better protect customers.

The finding demonstrates why claim validation alone cannot secure JWT-based authentication. Applications must cryptographically verify every token signature, reject unsigned tokens, restrict approved algorithms, validate issuer and audience values, and avoid mapping attacker-controlled claims directly to privileged local accounts.

In Titan’s case, one missing signature check neutralized several otherwise functioning access-control layers—and turned a public analytics endpoint into a potential gateway to an enormous Microsoft data environment.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post 16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records appeared first on Cyber Security News.