Reported by 3 outlets
How I Could’ve Accessed 17 Trillion Microsoft Records
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.07 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
A 16-year-old researcher known as Faav disclosed an authentication flaw in Microsoft's internal Titan analytics service that could have allowed administrator-level SQL queries against an environment he estimates at 17.3 trillion stored rows across 17 connected analytics databases. Titan's web interface sat behind a "VPN REQUIRED" page, but its backend API was separately reachable through a public Azure-hosted endpoint whose Swagger document exposed routes including /v2/Query, which processes raw SQL.
The core defect was JWT validation: the API expected Azure AD bearer tokens but checked token fields such as tenant ID, audience, application ID, and user claim without verifying the cryptographic signature. A synthetic token with alg set to none and the upn claim changed to admin resolved to a local administrator account and executed the submitted SQL. Faav limited testing to metadata, table descriptions, and tightly bounded one-row samples, and reported it to MSRC, which locked the endpoint down within days.
Microsoft has not confirmed any customer data was breached, and the researcher treats the impact as hypothetical. The lesson generalizes: signature verification failures on JWTs behind otherwise convincing perimeters, and internal analytics surfaces reachable through side-door cloud endpoints, are a recurring class. Watch whether Microsoft describes remediation beyond the single endpoint, since a validation bug of this kind rarely lives in exactly one service.
Timeline
-
original reporting
How I Could’ve Accessed 17 Trillion Microsoft Records
blog.faav.net · 18d ago · September 26th, 2026
submitted by /u/DerBootsMann [link] [comments]
via reddit r/cybersecurity: How I Could’ve Accessed 17 Trillion Microsoft Records
-
update from gbhackers.com
16-Year-Old Researcher Discovers Microsoft Authentication Bug Exposing 17.3 Trillion Records
gbhackers.com · 15d ago · September 28th, 2026
A 16-year-old security researcher known as Faav discovered a significant authentication flaw in Microsoft’s internal Titan analytics service. This vulnerability could have let an attacker impersonate an administrator and run unauthorized SQL queries. The researcher estimated that the vulnerable environment contained 17.3 trillion stored rows across 17 connected analytics databases. However, this figure represents potentially […] The post 16-Year-Old Researcher Discovers Microsoft Authentication Bug Exposing 17.3 Trillion Records appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
16-Year-Old Researcher Finds Microsoft Flaw Exposing Access to 17 Trillion Data Records
cyberpress.org · 15d ago · September 28th, 2026
The issue was not a confirmed customer-data breach. Faav said the potential impact was hypothetical and that he limited testing to metadata, table descriptions, and tightly bounded one-row samples. He reported the issue to the Microsoft Security Response Center (MSRC), which locked down the affected API endpoint within days. 16-Year-Old Researcher Finds Microsoft Flaw Titan’s web interface was protected behind a “VPN REQUIRED” page, but its backend API was publicly reachable through a separate Azure-hosted endpoint . A publicly exposed Swagger document listed several API routes, including /v2/Query , an endpoint capable of processing raw SQL queries. Although the API expected Azure AD bearer tokens, Titan reportedly validated fields in a JSON Web Token, including the tenant ID, audience, application ID, and user claim, without validating the cryptographic signature that proves a token was genuinely issued by a trusted identity provider. This flaw enabled the researcher to create a synthetic token using the alg: none setting, which indicates an unsigned JWT. After modifying the upn claim to admin , Titan allegedly resolved the value to a local administrator account and executed the submitted SQL query.
-
update from blog.faav.net
I Could've Accessed 17T Microsoft Records https:// blog.faav.net/how-i-couldve-ac cessed-17-trillion-microsoft-records Comments: https:// ne
blog.faav.net · 13d ago · September 30th, 2026
I Could've Accessed 17T Microsoft Records https:// blog.faav.net/how-i-couldve-ac cessed-17-trillion-microsoft-records Comments: https:// ne
via Mastodon https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
-
mentioned by blog.faav.net
A 16 year old researcher known as Faav reports that Microsoft's internal Titan analytics service checked JWT claims such as tenant, audience
blog.faav.net · 13d ago · September 30th, 2026