Microsoft pays $5,000 bounty to teen researcher for Titan vulnerability

A 16-year-old security researcher known as Faav has earned a US$5,000 bug bounty from Microsoft after discovering a vulnerability in the company’s internal Titan analytics platform.

Using a self-built AI hacking tool named Antares, the researcher bypassed authentication checks by identifying a public API that was accessible via a virtual private network (VPN). While most routes required Azure Active Directory authentication, one route accepted raw SQL database queries using only a valid-looking JSON Web Token (JWT).

Faav discovered that the Titan platform failed to properly validate the signature of the JWT, instead accepting any claims within the payload as long as the structure was correct. The researcher used archived table names from the Wayback Machine to assist the AI tool in navigating the system's checks.