Authentication Flaw in Microsoft Titan Exposed by Teen Researcher

• •A 16-year-old researcher identified a flaw in Microsoft's Titan analytics service.
• •The flaw allowed unauthorized SQL queries due to unsigned JWTs being accepted.
• •The vulnerability affects an estimated 17.3 trillion rows of data, including employee records.

A 16-year-old researcher, known as Faav, discovered a significant authentication flaw in Microsoft's Titan analytics service, which could have allowed unauthorized access to sensitive employee records and Bing analytics data. The flaw stemmed from Titan's failure to verify the signatures on JSON Web Tokens (JWTs), enabling Faav to impersonate an administrator and execute SQL queries against 17 databases containing an estimated 17.3 trillion rows of data. Faav utilized his own automated bug-hunting tool, Antares, to identify the vulnerability while participating in Microsoft's bug bounty program. The flaw was disclosed on September 28, 2026, and is associated with CVE-2026-88771 and CVE-2026-88772, both published on September 27, 2026. Although Faav did not access personal identifiable information (PII), the potential for targeted social engineering attacks exists due to the nature of the data exposed. Microsoft has since locked down the affected service.