{"id":61443,"date":"2026-09-30T18:29:41","date_gmt":"2026-09-30T18:29:41","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5300240"},"modified":"2026-09-30T18:29:41","modified_gmt":"2026-09-30T18:29:41","slug":"16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows\/","title":{"rendered":"16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows"},"content":{"rendered":"
<\/div>\n
<\/p>\n

security <\/p>\n

<\/a> <\/p>\n

It’s 2 am. Do you know what your teen is doing? <\/p>\n<\/p><\/div>\n

<\/p>\n

A 16-year-old security researcher named Faav found an authentication flaw in Microsoft\u2019s Titan analytics service that allowed him to gain administrator access, submit unauthorized SQL queries with no valid credentials, and potentially reach analytics databases containing an estimated 17.3 trillion stored rows.<\/p>\n

Titan is an internal analytics platform, and Redmond restricts access via its web interface to Microsoft employees. Faav, with an assist from an AI hackbot he built called Antares, found that he could access Titan\u2019s API through an Azure Cloud Services host because Titan didn\u2019t check the signature on a login token.<\/p>\n

Microsoft has since locked down the API and paid Faav a $5,000 bug bounty for his research. He says the breakthrough came after 10 days of authentication errors, when he returned to the problem after finishing Friday\u2019s schoolwork and finally managed to execute SQL as a Titan admin after 1 AM Saturday.<\/p>\n

\u201cIt was 2 AM,\u201d Faav said<\/a> in a blog about his findings. \u201cI wanted to yell, or at least say something out loud, but my parents were asleep. So I just sat there staring at 17,333,335,124,315 and checked the math again.\u201d<\/p>\n

He also notes that he rewrote his blog post at Microsoft\u2019s request, cut sections and numbers, and reworded the impact prior to publication.<\/p>\n

\u201cWe appreciate the opportunity to investigate the findings reported by Faav,\u201d Microsoft said in a statement provided to Faav for his blog. \u201cTheir submission and coordinated vulnerability disclosure helped us to better protect our customers by hardening our services. We value and appreciate safe security research under the terms of the Microsoft Bug Bounty Program and look forward to continuing to work with Faav in the future.\u201d<\/p>\n

A boy and his bot<\/h3>\n

The research began on August 25 when Antares found Titan\u2019s public API. For the next 10 days, the human and bot tested the service\u2019s JSON Web Token (JWT) authentication checks and email-formatted user principal names (UPNs), eventually finding an unsigned token that could reach Titan\u2019s local user lookup – but not a UPN that Titan recognized. <\/p>\n

Early on September 5, Faav changed the unsigned token\u2019s UPN from an email-formatted identity to admin. Titan recognized it as a local username, resolved it to local user ID 1, which held an admin role, and allowed him to run SQL. The takeaway, according to Faav:<\/p>\n

Titan validated the contents of the JWT (tenant, audience, app ID, user) but never verified the signature, the most important part of any authentication check. The authentication checks felt like a hotel where every door had a working keycard reader, but any keycard unlocked any room. Despite all the access-control logic existing in the app, the one missing piece made it all pointless. If you\u2019re a developer (or coding agent) reading this, the most important takeaway from this post is to make sure you verify signatures above all else when building auth. <\/span><\/p>\n

This gave Faav access to Titan\u2019s platform metadata database, and from there he could query application tables directly. The metadata contained:<\/p>\n