A 16-year-old security researcher who goes by the handle Faav has disclosed how he gained administrator access to an internal Microsoft analytics platform called Titan, after discovering that the system would accept login tokens with no valid digital signature attached. According to Faav’s own writeup, later reported on by Help Net Security and several other outlets, the flaw gave him access to roughly 17.3 trillion rows of data spread across 17 connected databases.
Titan is described as an internal Microsoft service used to store and query large volumes of analytics data. Like most modern web services, it relies on JSON Web Tokens, or JWTs, to prove that a logged in user is who they claim to be. A JWT normally carries a set of claims, such as a username, along with a cryptographic signature that proves those claims have not been tampered with. If a server properly checks that signature, changing the claims without the matching secret key should make the token invalid.
Faav explained that Titan was not making that check properly. He compared it to a bouncer checking the name on every ID but never looking at the photo: the service was reading the claims inside the token but not verifying the signature that was supposed to protect them. Using a bug hunting tool he built himself called Antares, Faav spent about ten days systematically probing Titan’s login process. He eventually tried a token with its algorithm field set to none and an empty signature section, a known technique called algorithm confusion, and found that Titan accepted it anyway. From there, changing the token’s upn field to admin was enough to gain administrator rights and the privileges of user ID 1, the platform’s top account.
With that access, Faav says he could query data including around 25,000 account and email entries, close to 18,000 employee email records, and roughly 15,000 employee organizational records containing job titles, departments and reporting hierarchy. He also reported being able to see Bing search analytics enriched with location data derived from IP address lookups.
Faav reported the issue to the Microsoft Security Response Center on September 5, 2026. Microsoft locked down the vulnerable endpoint four days later, on September 9, and paid out a 5,000 dollar bounty on September 17. In a statement, Microsoft said it appreciated the opportunity to investigate the report and that it values safe security research. According to Faav’s account, Microsoft also asked him to remove some sections and figures from his public writeup before it was published, a detail that has drawn some criticism from other researchers about how much editorial control large vendors exercise over bug bounty disclosures.
No CVE identifier has been publicly assigned to the flaw as of this writing, which is typical for issues affecting internal only services rather than software that customers install themselves. Microsoft has not indicated whether it found evidence of the flaw being exploited by anyone other than Faav.
Source: Help Net Security
