A skipped token-signature check let a teenager run admin queries on Microsoft's Titan
Faav, 16, impersonated an administrator on Microsoft's internal Titan service with an unsigned token, reaching an estimated 17.3 trillion rows. Microsoft disabled the API four days after his report and paid a $5,000 bounty.
The Engineer · Build desk
What happened
- Titan's documentation listed four API routes; three required Azure Active Directory bearer authentication, but the fourth, /v2/Query, accepted raw SQL and specified no such check.
- Faav's AI tool Antares found the API on a publicly reachable Azure host on August 25th, even though Titan's web interface showed a page saying a VPN was required.
- Beyond the analytics rows, the service exposed about 25,000 application account and email records, 17,990 employee email records and 15,001 employee-organization records.
- Faav says the row total is a metadata-based estimate of stored rows, not a count of unique people or of confirmed records he took.
Why it matters
- What it limits constraint A JSON Web Token's signature is the part that binds its claims to a trusted issuer; because Titan checked several claims and never the signature, every check it ran was validating values the caller could set.
- Who's exposed exposure Because /v2/Query accepted raw SQL with no authentication requirement, the only barrier left between a caller and the databases was a token check that never verified the token.
- What it sets up precedent The service was internal to Microsoft and the failure was still a skipped signature check, so the same gap is worth testing anywhere a service trusts token claims without verifying the signature.
Next story · Build · 1h ago
Microsoft ports Defender to the Linux desktop for Plan 2 and E5 or E7 customersConfirmed2 publishers
Faav found the gap by watching how Titan answered him. He changed claims in a test JSON Web Token and got new responses as the service checked the tenant, then the audience, then the application ID, then the user identity. Through all of it the token's signature stayed the same, and Titan never rejected it. He took that as proof the signature was not being validated, and sent a token with no signature at all [7].
The last step was human. Titan read the token's upn field as a local application username. Email-formatted identities failed, so Faav set the value to admin. Titan mapped that name to local user ID 1, which held the administrator role, and ran his query [8]. Antares, the AI tool he built to automate the repetitive probing, had reached the user lookup but never tried a username that was not an email address [18]. Faav says he saw the possibility himself after coming back to the lead past 1 a.m. on September 5th [9].
Faav wrote that AI and human intuition compounded in this case. In his account, Antares did ten days of work he did not have to do, and its persistence plus one human hunch made the find possible [16].
The row estimate deserves the caution he gave it. He says 30 of the 56 archived routing values were still active, leading through 24 configurations to 17 databases and 9,863 unique table names [10]. He summed row counts from database metadata, checked the total through two paths, and reached 17,333,335,124,315 [11]. To confirm the data was reachable and not only counted, he sampled two rows from a Bing analytics partition and went no further [12]. He says he did not bulk-download customer data or reach personally identifiable customer information [4].
The metadata was the more concrete exposure. Some of the employee records carried job titles, departments and management hierarchy for staff tied to Titan, and Faav says he did not test whether that could be used for social engineering [14].
Faav reported the flaw to the Microsoft Security Response Center [19]. Microsoft said his submission and coordinated disclosure helped it harden its services [20]. He also disclosed that Microsoft had editorial control over his Titan writeup and asked for sections and figures to be cut or reshaped before publication, while the 17.3 trillion figure stays his [21]. This was his second public Microsoft disclosure; in July 2025, at 15, he reported exposure in Microsoft Guest Check-In [15]. He says he has "spent the year hacking Microsoft off and on around school" [17].
What to watch
- Whether Microsoft issues a CVE or post-incident writeup beyond its statement that the disclosure helped it harden services.
- Whether other internal Microsoft services handle unsigned tokens the way /v2/Query did.
- Whether the editorial control Microsoft had over Faav's post changed the scope figures he published.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+30
- Incentives55
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A missing token-signature check let Faav, a 16-year-old security researcher, impersonate an administrator on Microsoft's internal Titan analytics service and run SQL queries, according to a disclosure he published on September 25th.
- [2]
Faav estimated that 17 connected analytics databases held about 17.3 trillion rows reachable through the flaw, a metadata-based estimate of stored rows, not a count of unique people or confirmed customer records taken.
- [3]
Microsoft paid Faav a $5,000 bug bounty on September 17th, according to his account.
- [4]
Faav says he used table descriptions, metadata and limited samples to assess the exposure and did not bulk-download customer data or access personally identifiable customer information.
- [5]
On August 25th, Faav's tool Antares found Titan's API behind a publicly reachable Azure host, even though the service's web interface displayed a VPN-required page.
- [6]
Titan's API documentation listed four routes; three specified Azure Active Directory bearer authentication, while the fourth, /v2/Query, accepted raw SQL and did not specify the same requirement.
- [7]
Changing claims in a test JSON Web Token produced new responses as Titan checked tenant, audience, application ID and then user identity, while the token's signature stayed unchanged, a pattern that led Faav to test a token with no signature.
- [8]
Titan treated the token's upn field as a local application username; after email-formatted identities failed, Faav changed the value to admin, and Titan mapped that username to local user ID 1, which had the administrator role, and executed his query.
- [9]
Antares had reached the user lookup but had not tried the non-email username; Faav says he recognized that possibility after returning to the lead himself after 1 a.m. on September 5th.
- [10]
Faav says 30 of the 56 archived routing values were active and led through 24 configurations to 17 databases and 9,863 unique table names.
- [11]
Faav summed row counts from database metadata, checked the result through two metadata paths, and reached a total of 17,333,335,124,315, which he cautioned could include historical, duplicated and derived data.
- [12]
Faav says he sampled two individual rows from a Bing analytics partition to confirm the data was reachable and did not attempt a bulk query or correlate records across datasets.
- [13]
Faav reported finding approximately 25,000 application account and email records, 17,990 employee email records and 15,001 employee-organization records, plus database configurations and dashboard and dataset definitions.
- [14]
Faav said some employee information included job titles, departments and management hierarchy for staff associated with Titan, and that he did not test whether the material could be used for social engineering.
- [15]
This was Faav's second public Microsoft disclosure; in July 2025, at age 15, he published a report about exposure in Microsoft Guest Check-In.
- [16]
AI and human intuition compounded here. Antares did ten days of work I didn't have to [...] Its persistence, plus one human hunch, is what made this find possible.
- [17]
spent the year hacking Microsoft off and on around school.
- [18]
Antares is a personal AI-assisted security tool Faav built to automate the repetitive parts of his security probing.
- [19]
Microsoft shut down the affected API on September 9th, four days after Faav says he reported the vulnerability to the Microsoft Security Response Center.
- [20]
Microsoft said Faav's submission and coordinated disclosure helped it harden its services.
- [21]
Faav disclosed that Microsoft had editorial control over the Titan post, asking for sections and figures to be cut or reshaped before publication; the 17.3 trillion figure remains his.
Sources
2 independent publishers whose own reporting we read for this story.
- runtimewire.comTeen researcher found unsigned-token flaw in Microsoft's internal Titan service, with 17 trillion rows reachable
1 article · September 27, 2026
- tomshardware.comTeenager hacks open Microsoft database with 17 trillion total rows and 25,000 user accounts
1 article · September 28, 2026
Topics and entities
Topics
- AI-Assisted Security Research
- Bug Bounty Programs
- JWT signature validation
Entities
- Azure Active Directory
- Microsoft
- Microsoft Security Response Center
- JSON Web Token
- Bing