--- title: 16-year-old researcher found a Microsoft bug, got admin... description: A 16-year-old security researcher named Faav, working with an AI hacking bot he built called Antares, discovered an authentication flaw in Microsoft's internal... canonical: https://daily.dev/posts/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows-br9vggrsx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows | daily.dev og:description: A 16-year-old security researcher named Faav, working with an AI hacking bot he built called Antares, discovered an authentication flaw in Microsoft's internal... og:url: https://daily.dev/posts/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows-br9vggrsx og:image: https://api.daily.dev/og/posts/br9vGgrSX.png og:image:alt: 16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows **[The Register](https://daily.dev/sources/theregister)** · 5 min read · 0 upvotes · 0 comments ## Summary A 16-year-old security researcher named Faav, working with an AI hacking bot he built called Antares, discovered an authentication flaw in Microsoft's internal Titan analytics platform. The bug: Titan validated JWT contents like tenant, audience, and user, but never verified the token signature. By swapping the UPN field in an unsigned token to 'admin', Faav resolved to local user ID 1, an admin account, and gained the ability to run arbitrary SQL. This exposed metadata including account records, employee data, dashboards, and ultimately access to 17 connected analytics databases spanning 9,863 tables, estimated at 17.3 trillion stored rows. Microsoft locked down the API, asked him to stop testing and verify his IP, and paid a $5,000 bug bounty. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the actual authentication flaw a researcher found in Microsoft's Titan analytics platform? Titan validated JWT claims like tenant, audience, app ID, and user, but never verified the token's cryptographic signature. This let a researcher forge an unsigned token, change its UPN field to the local username 'admin', and have it resolve to local user ID 1, an account with admin privileges, granting the ability to run arbitrary SQL against Titan's databases. _daily.dev surfaces writeups like this for developers hardening JWT-based auth flows._ ### How much data was exposed by the Microsoft Titan authentication bug found by a teenage bug bounty hunter? Through 30 live routing values resolving across 24 configurations, the flaw exposed 17 connected analytics databases spanning 9,863 unique table names, estimated at roughly 17.3 trillion stored rows including duplicated and historical data. It also exposed around 25,000 account records, 17,990 employee emails, and tens of thousands of dashboards and dataset definitions before Microsoft locked down the endpoint. _developers assessing blast radius from an auth bug can track cases like this on daily.dev._ ### How much did Microsoft pay for the Titan authentication vulnerability bug bounty report? Microsoft paid the 16-year-old researcher $5,000 through its Bug Bounty Program on September 17, after locking down the vulnerable API endpoint following his responsible disclosure. Microsoft had asked him to stop testing and provide his IP address to confirm no malicious activity before remediating the exposure. _anyone weighing bug bounty payouts against severity can follow disclosures like this on daily.dev._ ## Similar posts on daily.dev - [Microsoft warns of max severity Entra ID flaw exploited in attacks](https://daily.dev/posts/microsoft-warns-of-max-severity-entra-id-flaw-exploited-in-attacks-trnyz1ea4) · BleepingComputer · 5 upvotes · 0 comments - [From Bug to Schema: Exploring Error-Based SQL Injection on an Authenticating Portal](https://daily.dev/posts/from-bug-to-schema-exploring-error-based-sql-injection-on-an-authenticating-portal-xbvfkmcgs) · InfoSec Write-ups · 0 upvotes · 0 comments - [Full Disclosure: A Third \(and Fourth\) Azure Sign-In Log Bypass Found](https://daily.dev/posts/full-disclosure-a-third-and-fourth-azure-sign-in-log-bypass-found-6jqpofnhm) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#azure](https://daily.dev/tags/azure), [#authentication](https://daily.dev/tags/authentication), [#jwt](https://daily.dev/tags/jwt) [View this post on daily.dev](https://daily.dev/posts/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows-br9vggrsx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows","url":"https://daily.dev/posts/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows-br9vggrsx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows-br9vggrsx"},"datePublished":"2026-09-30T18:30:29.318Z","dateModified":"2026-09-30T18:31:02.222Z","description":"A 16-year-old security researcher named Faav, working with an AI hacking bot he built called Antares, discovered an authentication flaw in Microsoft's internal...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/471e7bde0d7c6fc2c3b79472df2b8be3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/471e7bde0d7c6fc2c3b79472df2b8be3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows-br9vggrsx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,azure,authentication,jwt","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/16-year-old-researcher-found-a-microsoft-bug-got-admin-access-to-databases-with-17-3-trillion-rows-br9vggrsx#faq","mainEntity":[{"@type":"Question","name":"What was the actual authentication flaw a researcher found in Microsoft's Titan analytics platform?","acceptedAnswer":{"@type":"Answer","text":"Titan validated JWT claims like tenant, audience, app ID, and user, but never verified the token's cryptographic signature. This let a researcher forge an unsigned token, change its UPN field to the local username 'admin', and have it resolve to local user ID 1, an account with admin privileges, granting the ability to run arbitrary SQL against Titan's databases. daily.dev surfaces writeups like this for developers hardening JWT-based auth flows."}},{"@type":"Question","name":"How much data was exposed by the Microsoft Titan authentication bug found by a teenage bug bounty hunter?","acceptedAnswer":{"@type":"Answer","text":"Through 30 live routing values resolving across 24 configurations, the flaw exposed 17 connected analytics databases spanning 9,863 unique table names, estimated at roughly 17.3 trillion stored rows including duplicated and historical data. It also exposed around 25,000 account records, 17,990 employee emails, and tens of thousands of dashboards and dataset definitions before Microsoft locked down the endpoint. developers assessing blast radius from an auth bug can track cases like this on daily.dev."}},{"@type":"Question","name":"How much did Microsoft pay for the Titan authentication vulnerability bug bounty report?","acceptedAnswer":{"@type":"Answer","text":"Microsoft paid the 16-year-old researcher $5,000 through its Bug Bounty Program on September 17, after locking down the vulnerable API endpoint following his responsible disclosure. Microsoft had asked him to stop testing and provide his IP address to confirm no malicious activity before remediating the exposure. anyone weighing bug bounty payouts against severity can follow disclosures like this on daily.dev."}}]} ```