A researcher said a missing authentication check let him query Microsoft’s internal analytics service without valid credentials. His 17.3-trillion-row estimate was not a count of stolen records.
Microsoft has locked down the API for Titan, its internal analytics service, after a researcher reported gaining administrator access and running database queries without valid credentials, according to The Register’s September 30 report. The flaw potentially exposed employee directory information and connected analytics data.
Titan’s web interface is restricted to Microsoft employees. But researcher Faav said he reached its application programming interface, or API—the interface software uses to communicate with a service—through an Azure Cloud Services host.
According to Faav, Titan checked the identity and application information inside a JSON Web Token, or JWT, but did not verify its digital signature. A login token carries claims about who a user is. Signature verification checks that those claims came from a trusted issuer and have not been altered; checking the contents alone does not establish that trust.
Faav said Titan accepted an unsigned token, matched its claimed identity to a local account with an administrator role, and allowed him to run SQL queries—commands used to retrieve or work with database information. That gave him access to Titan’s platform metadata database, which describes the service’s accounts, datasets and database connections, and allowed him to query application tables directly.
The reported metadata included 17,990 employee email records and 15,001 employee organization records. Titan’s directory also exposed job titles, departments and management hierarchy. Faav said this information could help with social-engineering attacks, which use deception to manipulate people, but explicitly said he had not tested or demonstrated that use.
His reported testing included two rows from a Bing analytics sample containing search information, identifiers and country- or state-level location information. Faav said those location values did not reveal precise user locations.
The much larger figure—about 17.3 trillion rows—was a storage estimate derived from metadata. Faav reported finding connections to 17 analytics databases spanning 9,863 unique table names. He said the estimated total likely included historical, duplicated and derived data. It was not a count of records stolen or individually queried.
Microsoft asked Faav to stop testing between September 6 and 8, then locked down the endpoint, The Register reported. Microsoft told him his report had prompted “immediate investigation and remediation to address the remaining exposure.” The company awarded him a $5,000 bug bounty on September 17.
In a statement supplied to Faav for his blog, Microsoft acknowledged his submission and coordinated vulnerability disclosure, saying they had helped the company harden its services. The reported protective action was the lockdown of the API endpoint through which he had gained access.
Reddit plans to test the change outside the US this quarter. Proposed exceptions would keep the homepage and content reached through search engines or shared links open without login.
2 min
Hudson Rock says newly obtained FortiGate files contain local-user and directory-binding records, adding older material to its credential-exposure investigation.
2 min
The Gemini for Home changes also target mistaken timer requests and controls for devices in other rooms. Rollout began on 29 October 2026 and may take time to reach everyone.
2 min
