A 16-year-old security researcher operating under the pseudonym Faav uncovered a serious authentication vulnerability in Microsoft Titan, the company's internal analytics platform used for large-scale data analysis.
The flaw stemmed from improper validation of JSON Web Token signatures. Titan checked tenant identifiers, application details, and usernames supplied in tokens but never verified their cryptographic signatures. As a result, an attacker could craft a valid-looking token that mapped the username "admin" to a local administrator account without any credentials or prior account compromise.
Once authenticated as an administrator, the researcher gained the ability to run arbitrary SQL queries against connected data sources. During testing, Faav discovered 17 ClickHouse databases containing metadata for almost 10,000 unique tables. The combined storage was estimated at 17.3 trillion rows, although this figure includes duplicates, historical snapshots, and derived datasets rather than unique user records.
The researcher observed metadata and tens of thousands of records related to employee accounts, addresses, and organizations. Two limited queries against Bing analytics returned single rows each. Faav stated that no customer personal data was examined in bulk and no mass exfiltration occurred.
Faav responsibly disclosed the issue to Microsoft on September 5. The company disabled public access to the affected API on September 9 and paid the researcher a $5,000 bounty on September 17. There is currently no evidence that threat actors exploited the vulnerability prior to its remediation.
