16-Year-Old Researcher Uncovers Microsoft Titan Auth Flaw, Potentially Exposing Trillions of Records
A 16-year-old security researcher discovered a critical authentication vulnerability in Microsoft's internal Titan analytics service, which could have allowed forged administrator access and unauthorized SQL queries, potentially exposing an estimated 17.3 trillion database rows.
A remarkably young security researcher, identified only as Faav, has uncovered a significant authentication flaw within Microsoft's internal Titan analytics service. This vulnerability, if exploited, could have granted attackers forged administrator privileges and enabled them to execute unauthorized SQL queries, potentially exposing an estimated 17.3 trillion database rows. While the scale of potential data exposure is staggering, Faav has stressed that the impact was largely hypothetical, as no customer personally identifiable information (PII) was accessed, and there is no evidence of malicious exploitation.
The investigation began on August 25, 2026, when Faav's AI-powered hacking assistant, Antares, detected a public API associated with the Titan service, despite its web interface indicating restricted access. This API, hosted on Azure Cloud Services, was further illuminated by an exposed Swagger document that detailed four specific routes, including one designated for raw SQL queries. Archived data from previous Titan versions provided additional context, revealing 56 table definitions and a routing value named 'TestData,' which Faav used to initiate controlled testing.
Initial attempts to access the API without proper authorization headers resulted in the expected HTTP 401 Unauthorized responses. However, over the subsequent ten days, Antares meticulously manipulated JSON Web Token (JWT) claims and analyzed Titan's error messages. The service's authentication mechanism was found to be flawed: it checked the tenant ID, audience, application ID, and user identity, but critically, it continued to process modified claims without cryptographically verifying the token's original signature.
This oversight allowed Faav to craft a synthetic token where the algorithm was set to 'none' and the signature was left empty. Titan accepted this unsigned token. The next challenge was to provide a recognized user identity. After initial attempts using email-formatted User Principal Names failed, Faav reconsidered how the backend might interpret the 'upn' field. By replacing it with the value 'admin,' Titan incorrectly mapped this to local user ID 1, granting the 'Admin' role and successfully executing a basic 'SELECT 1' query.
With administrative access established, Faav explored the Titan environment. This limited exploration revealed the service's platform metadata database and other connected analytics environments. The accessible metadata included a substantial amount of information, such as approximately 25,000 account and email records, 17,990 employee email entries, 15,001 employee organization records, 355 database configurations, 20,979 virtual-dataset SQL definitions, 24,569 dashboards, 425,891 charts, and 27,347 dataset definitions. Further confirmation showed that Bing search analytics were also reachable through two restricted one-row queries.
To estimate the potential data exposure, Faav tested all 56 archived routing values with a 'SELECT 1' query. Thirty of these routes remained active, connecting through 24 configurations to 17 ClickHouse analytics databases that contained 9,863 unique table names. By analyzing system tables, Faav calculated the estimated total number of rows across these databases to be 17,333,335,124,315. However, Faav cautioned that this figure likely included historical, duplicated, and derived data, and should not be interpreted as 17.3 trillion unique individuals or exposed customer records.
Faav responsibly disclosed the vulnerability to the Microsoft Security Response Center on September 5, 2026, initiating case 144051. Microsoft responded swiftly, locking down the affected API endpoint on September 9. The company acknowledged Faav's contribution by awarding a $5,000 bounty on September 17 and coordinated the public disclosure. Microsoft stated that the researcher's report was instrumental in hardening their services and enhancing customer protection.
This incident underscores a critical security principle: JWTs must be rigorously validated. Relying solely on claim validation is insufficient. Applications must implement robust cryptographic signature verification for all tokens, reject unsigned tokens, restrict the set of approved signing algorithms, validate issuer and audience claims, and crucially, avoid mapping attacker-controlled claims directly to privileged local accounts. In Titan's case, the absence of a single signature check undermined multiple layers of access control, transforming a seemingly innocuous analytics endpoint into a potential gateway to a vast Microsoft data ecosystem.