Microsoft Titan analytics: forged unsigned JWT → admin SQL across ~17.3T rows (Faav / MSRC 144051; endpoint locked 9 Sep)
Researcher Faav (blog.faav.net, published 25 September 2026) details an authentication flaw in Microsoft’s internal Titan analytics API: the service checked JWT claims (tenant, audience, app ID, user) but never verified the token signature, so a forged token with upn set to admin enabled administrator-level SQL without real credentials. Controlled testing reached 30 live routing targets → 17 ClickHouse analytics databases (~9,863 table names) with metadata totaling an estimated 17.3 trillion stored rows (Bing search analytics among them); Faav states only metadata and bounded one-row samples were accessed and no customer PII was taken. Reported to MSRC (case 144051); MSRC asked testing to stop 6–8 Sep and locked the API endpoint on 9 September 2026. Microsoft statement in the write-up: coordinated disclosure helped harden services under the Bug Bounty program. Impact described as hypothetical for a malicious actor; no public CVE assigned in the write-up. Primary: Faav blog; wire: Cyber Security News 26 Sep.
- Product
- Microsoft Titan internal analytics API (JWT auth / SQL query surface)
- Versions
- Internal Microsoft service; researcher: vulnerable JWT path locked down 9 Sep 2026 after MSRC 144051. No customer-facing product version string published.
- Exploited in Australia?
- unknown
- Patch to
- Microsoft: endpoint locked 9 Sep 2026 (researcher). Defenders: treat forged-JWT / missing signature verification as a class risk on any Entra-facing or internal analytics APIs; verify JWT signatures before trust; inventory similar claim-only checks. No public customer patch package — vendor-side fix.
Primary: Faav — How I Could’ve Accessed 17 Trillion Microsoft Records (25 Sep 2026) · Vendor: Microsoft MSRC (case 144051; Titan API locked 9 Sep 2026 per researcher) · Cyber Security News — Faav / Titan auth write-up summary (26 Sep 2026)