JWT Authentication Flaw Exposed Microsoft Titan Analytics Data

A security researcher known as Faav discovered a critical authentication flaw in Microsoft’s internal Titan analytics service that allowed unauthenticated attackers to forge administrator JWTs and execute arbitrary SQL queries. Titan reportedly accepted unsigned tokens using the none algorithm and mapped an attacker-controlled upn claim of admin to local user ID 1, granting the Admin role without Microsoft credentials.

Faav limited validation to metadata and one-row queries, reporting no access to customer PII and no evidence that the issue was exploited maliciously. The reachable environment was estimated to contain roughly 17.3 trillion stored rows—an estimate that includes historical, duplicated, and derived data rather than unique customer records or individuals. Microsoft received the disclosure on September 5, restricted the exposed API on September 9, and awarded the researcher a $5,000 bug bounty on September 17.