Microsoft security flaw exposed by 16-year-old researcher

A 16-year-old security researcher, known by the alias Faav, discovered a significant security flaw in Microsoft’s internal analytics service, Titan. By exploiting an unsigned authentication token and using the username ‘admin’, the researcher was able to execute SQL queries with administrative privileges.

The vulnerability exposed an estimated 17.3 trillion rows of metadata across 17 connected databases. While the researcher did not access customer data, the exposure included metadata from approximately 25,000 accounts, 17,990 employee emails, and 24,569 internal dashboards. The breach was facilitated by an API for Titan hosted on Azure that lacked proper signature validation.

Faav reported the finding to the Microsoft Security Response Center on September 5. Microsoft closed the access point on September 9 and subsequently paid the researcher a $5,000 bounty on September 17. The researcher utilized an AI tool named Antares to help locate the exposed API during the discovery process.