A public interface to Microsoft’s internal Titan analytics platform accepted unsigned JSON Web Tokens, allowing a remote researcher to impersonate an administrator and submit SQL queries without holding Microsoft credentials. The weakness potentially placed an enormous collection of analytics data within reach, although the researcher limited testing, found no evidence of abuse, and stressed that the headline storage estimate does not represent trillions of individual people.

The finding came from a 16-year-old security researcher who uses the name Faav. An AI-assisted testing system called Antares identified Titan in August 2026. While its web page said a VPN was required, an API hosted through Azure Cloud Services remained reachable from the internet. A publicly exposed Swagger document described several routes, including an endpoint that accepted raw SQL.

How the authentication check failed

Unauthenticated requests initially received the expected HTTP 401 response. The problem appeared when token claims were altered. Titan checked fields such as the tenant, audience, application and user identity, but did not reliably verify the cryptographic signature binding those claims to a trusted issuer. That distinction is fundamental: inspecting a token’s contents cannot establish that the contents are genuine.

During controlled testing, an unsigned token using the JWT “none” algorithm was accepted. After several email-style usernames failed, the value “admin” mapped to a local account with user ID 1 and the Admin role. A harmless SELECT 1 query then executed successfully, demonstrating that the forged identity had crossed the authorization boundary.

The exposed service connected to multiple analytics environments. Metadata visible during limited exploration included account and employee email entries, database configurations, virtual-dataset queries, dashboards, charts and dataset definitions. Two tightly restricted, single-row queries also confirmed that Bing search analytics were reachable. The researcher said no people were identified and records were not joined across datasets.

Understanding the 17.3 trillion figure

Archived Titan pages listed 56 routing values, 30 of which still responded. Those routes led through 24 configurations to 17 ClickHouse databases containing 9,863 unique table names. Database metadata produced an aggregate estimate of about 17.3 trillion stored rows.

That number should be interpreted carefully. It can include historical copies, derived analytics and duplicates, and it is not a count of unique users or confirmed exposed customer records. The issue was nevertheless severe because an internet-accessible authentication bypass could have enabled broad queries across a large internal data estate.

Microsoft’s response and the wider lesson

Faav reported the issue to the Microsoft Security Response Center on September 5. Microsoft restricted the endpoint four days later, awarded a $5,000 bounty on September 17 and coordinated disclosure. Neither the researcher nor Microsoft reported evidence of malicious exploitation.

For defenders, the incident is a reminder that every service accepting JWTs must validate more than the visible claims. Secure implementations should:

• Cryptographically verify every signature against an explicitly trusted key.
• Reject unsigned tokens and disallow unexpected algorithms.
• Validate issuer, audience, expiry and other contextual restrictions.
• Avoid mapping attacker-controlled identity fields directly to privileged local accounts.
• Keep administrative and data-query APIs off the public internet unless access is necessary.

Security teams should also inventory Swagger and other API documentation exposed by production services. Documentation can dramatically reduce an attacker’s discovery work, especially when it reveals query routes or internal naming conventions. Layered controls such as private connectivity, narrowly scoped service identities, query restrictions and strong audit logging can limit the damage if one authentication component fails.

The Titan case did not become a known breach, but it illustrates how a small validation omission can neutralize several otherwise correct checks. Token security depends on proving who signed an assertion, not merely confirming that the assertion contains plausible values.

Source: Cyber Security News.