Microsoft Titan Analytics JWT 'alg:none' Authentication Bypass Exposed Access to 17.3 Trillion ClickHouse Rows

Key facts

Detection coverage

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2675 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unsigned 'alg:none' JWT Presented to Public-Facing Analytics API Gateway

Detects an Authorization bearer token whose JWT header decodes to alg:none (base64 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0') or whose signature segment is empty/missing, presented against an internet-reachable analytics/BI API gateway that fronts internal data stores. This is the exact forgery mechanism Faav used to bypass Titan's authentication and gain an unverified session (MSRC Case 144051).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1606, T1595.002, T1588.002
• Data sources: azure_api_management_gateway_logs, azure_application_gateway_waf_logs
• Severity: high
• Confidence: high

Splunk SPL

`comment("Detects alg:none / empty-signature JWTs at an internet-facing internal-analytics API gateway - Titan alg:none bypass pattern")`
index=api_gateway sourcetype="azure:apim:gatewaylogs" earliest=-24h
| eval auth_header=coalesce('RequestHeaders.Authorization', http_authorization)
| where isnotnull(auth_header) AND like(auth_header, "Bearer %")
| rex field=auth_header "Bearer\s+(?<jwt>\S+)"
| eval jwt_parts=split(jwt, ".")
| eval jwt_header_b64=mvindex(jwt_parts,0)
| eval jwt_signature=mvindex(jwt_parts,2)
| where jwt_header_b64="eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0" OR isnull(jwt_signature) OR len(jwt_signature)=0
| stats count as attempt_count, min(_time) as first_seen, max(_time) as last_seen, values(uri_path) as targeted_endpoints, values(ApiId) as api_id by src_ip, dest_host
| where attempt_count > 0
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

ApiManagementGatewayLogs
| where TimeGenerated > ago(24h)
| extend AuthHeader = tostring(parse_json(tostring(RequestHeaders))["Authorization"])
| where AuthHeader startswith "Bearer "
| extend Token = substring(AuthHeader, 7)
| extend TokenParts = split(Token, ".")
| extend HeaderB64 = tostring(TokenParts[0]), SignatureSegment = tostring(TokenParts[2])
| where HeaderB64 == "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0" or isempty(SignatureSegment)
| summarize AttemptCount = count(), TargetedOperations = make_set(OperationId) by CallerIpAddress, ApiId
| where AttemptCount > 0

Sigma

title: Unsigned alg:none JWT Presented to Public-Facing API Gateway
id: e3a1c2d4-6f5b-4a8e-9c3d-1a2b3c4d5e6f
status: experimental
description: Detects an Authorization bearer token whose JWT header decodes to alg:none or whose signature segment is empty, the exact forgery technique used to bypass Titan's authentication and impersonate an admin identity.
references:
  - https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
author: Threadlinqs Team
date: 2026-09-26
tags:
  - attack.initial-access
  - attack.t1190
  - attack.credential-access
  - attack.t1606
  - attack.reconnaissance
  - attack.t1595.002
  - cwe.347
logsource:
  product: azure
  service: apimanagement
detection:
  selection_header:
    Authorization|contains: 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0'
  selection_emptysig:
    Authorization|re: '\.$'
  condition: selection_header or selection_emptysig
falsepositives:
  - Non-production/test clients intentionally issuing debug tokens with alg:none for local development
  - Automated API health-check or synthetic-monitoring probes replaying cached malformed tokens
level: high

Known false positives:

• Non-production/test clients intentionally issuing debug tokens with alg:none for local development
• Automated API health-check or synthetic-monitoring probes replaying cached malformed tokens

Tuning notes: Maintain an explicit algorithm allow-list (e.g., RS256/HS256 only) and alert on any token whose header is alg:none, empty, or outside that list; scope the rule to the internet-facing gateway listener to avoid firing on internal service-mesh mTLS test traffic.

• 🔒 Unsigned 'alg:none' JWT Presented to Public-Facing Analytics API Gateway · unlock with TL Creds
• 🔒 Forged 'upn' Claim Resolving to Privileged Admin Role Without an Email-Formatted Identity · unlock with TL Creds
• 🔒 High-Volume Cross-Database Query Enumeration via Analytics Aggregation API · unlock with TL Creds
• 🔒 Unsigned 'alg:none' JWT Presented to Public-Facing Analytics API Gateway · unlock with TL Creds
• 🔒 Forged 'upn' Claim Resolving to Privileged Admin Role Without an Email-Formatted Identity · unlock with TL Creds
• 🔒 High-Volume Cross-Database Query Enumeration via Analytics Aggregation API · unlock with TL Creds
• 🔒 Forged 'upn' Claim Resolving to Privileged Admin Role Without an Email-Formatted Identity · unlock with TL Creds
• 🔒 High-Volume Cross-Database Query Enumeration via Analytics Aggregation API · unlock with TL Creds

Indicators of compromise

As of 2026-09-26, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-2675.

Technical analysis

Microsoft restricted the endpoint on 2026-09-09, four days after the 2026-09-05 MSRC report (Case 144051), and paid a $5,000 bounty; no evidence of malicious exploitation or customer PII access was found.

Titan is an internal Microsoft analytics/business-intelligence platform that fronts dozens of ClickHouse databases used for telemetry and reporting (including Bing search analytics). Its web console displays a 'VPN REQUIRED' page, but researcher Faav's AI-assisted reconnaissance tool 'Antares' (built on Codex and Claude models) discovered that Titan's backend API was independently reachable over the public internet via an Azure Cloud Services-hosted endpoint, with a Swagger document listing routes including /v2/Query, which accepted raw SQL text.

On 2026-08-25, Antares recovered 56 historical table/route definitions for Titan from Wayback Machine archives, giving Faav a map of the service's surface before any live probing. Titan authenticated callers using JSON Web Tokens carrying tenant ID (tid), audience (aud), application ID (appid), and a upn (user principal name) claim. Over roughly ten days of systematic testing (2026-08-25 to 2026-09-05), Faav found that Titan validated the presence and structure of these claims but never cryptographically verified the token's signature or issuer. Around 1 AM on 2026-09-05, Faav submitted a token with header {"alg":"none","typ":"JWT"} and an empty signature section (a bare trailing period instead of a signature), replacing the upn value with the literal string 'admin' instead of an email-formatted identity. Titan's backend treated upn as a local application username rather than a verified identity: 'admin' resolved to local user ID 1, which held the Admin role, and a SELECT 1 validation query executed successfully -- confirming unauthenticated, unauthorized arbitrary SQL execution against Titan's connected data stores.

Of the 56 archived routing targets, 30 remained active. These routed through 24 database configurations to 17 distinct ClickHouse analytics database instances, spanning roughly 9,863 unique table names. Using the forged admin session, Faav queried Titan's own metadata database (revealing ~25,000 account/email records, 17,990 employee email records, 15,001 employee/org records, 355 database configurations, 20,979 SQL definitions, and roughly 24,569 dashboards / 425,891 charts / 27,347 dataset definitions) and ran two limited one-row queries against Bing search analytics tables, which returned search-activity records with country/state-level location data and Microsoft User IDs (MUIDs). Faav deliberately limited testing to metadata and single-row samples and stated no customer PII was accessed and no evidence of prior malicious exploitation was found; the disclosed row-count estimate (17,333,335,124,315) reflects the theoretical scope reachable through the flaw, not confirmed exfiltration.

Faav reported the issue to the Microsoft Security Response Center on 2026-09-05 (Case 144051). MSRC asked the researcher to halt further testing and confirm their source IP while investigating (2026-09-06 to 2026-09-08). Microsoft restricted/locked down the exposed Titan API endpoint on 2026-09-09 -- four days after the report -- and awarded a $5,000 bug bounty on 2026-09-17. The write-up underwent Microsoft editorial coordination (2026-09-22 to 2026-09-24) ahead of public disclosure on 2026-09-26. No CVE was assigned, consistent with this being an internal-tooling authentication design flaw rather than a shipped product vulnerability.

The root cause is a broken JWT trust model: Titan inspected structural claims (tenant, audience, app ID, user) while skipping the one check -- signature verification against a trusted issuer/key -- that makes any of those claims trustworthy. This single failure undermined multiple compensating controls Microsoft had layered around the service, including its VPN-only frontend and role-based access control, because an attacker-controlled identity claim could bypass all of them once the backend API was reachable at all. The incident illustrates a recurring class of API authentication bypass (JWT 'alg:none' / unverified signature) with severe blast radius when the exposed service is a data-aggregation platform sitting in front of many downstream databases.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1078.004 Cloud Accounts

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Discovery

T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

lateral-movement

T1550.001 Application Access Token

Resource Development

T1588.002 Tool

Reconnaissance

T1591.004 Identify Roles; T1595.002 Vulnerability Scanning

Credential Access

T1606 Forge Web Credentials

Remediation

Patches

• Microsoft restricted/locked down the exposed Titan API endpoint on 2026-09-09, four days after the 2026-09-05 MSRC report (Case 144051)

Immediate actions

• Restrict or remove any publicly reachable API surface for internal analytics tooling whose web frontend is meant to be VPN-only (Titan's backend API was reachable via its Azure Cloud Services host despite the console requiring VPN)
• Audit every JWT-consuming service for explicit algorithm allow-listing that rejects 'alg:none' and any algorithm the service does not itself expect
• Enforce cryptographic signature verification against a trusted issuer/key for every JWT before trusting any embedded claim (tenant ID, audience, app ID, upn/user identity)

Workarounds

• Pending remediation of a similar defect, network-isolate or take offline any API surface for internal analytics tooling that mirrors a VPN-required frontend until signature verification and claim-to-identity binding are fixed

Longer-term hardening

• Validate identity claims such as upn/oid against an authoritative identity provider or directory rather than trusting client-supplied claim values, and never let a claim resolve directly to a privileged local user ID (e.g. 'admin' -> user ID 1 with Admin role) without an independent authorization check
• Apply zero-trust review to internal analytics/BI platforms that front large aggregated data stores, since a single authentication defect can expose every connected downstream database at once
• Periodically re-verify that VPN-gated internal services have no parallel publicly reachable API surface (e.g. via Azure App Service / API Management / Cloud Services), including checking for exposed Swagger/OpenAPI documents
• Treat platform metadata (database names, table structures, SQL definitions, dashboard/dataset counts) as sensitive, since it functions as an attacker roadmap even when row-level data stays protected

Affected and fixed versions

• Microsoft — Titan (internal analytics/BI service)
  Vulnerable versions: Production deployment prior to 2026-09-09
  Fixed in: Production deployment from 2026-09-09 onward (exposed API endpoint restricted)

Timeline

• 2026-08-25 Faav begins roughly ten days of systematic JWT claim testing against Titan's API, probing responses to different claim values through observed error messages.
• 2026-08-25 Researcher Faav's AI-assisted tool 'Antares' identifies Titan's publicly reachable Azure-hosted API and recovers 56 archived table/route definitions from the Wayback Machine, despite Titan's web console requiring a VPN.
• 2026-09-05 Faav reports the vulnerability to the Microsoft Security Response Center, opening Case 144051.
• 2026-09-05 At approximately 1 AM, Faav submits an unsigned 'alg:none' JWT with the upn claim set to the literal string 'admin'; Titan resolves it to local user ID 1 with the Admin role and executes a SELECT 1 validation query, confirming arbitrary SQL execution.
• 2026-09-06 MSRC begins responding to the report, requesting that Faav halt further testing and confirm the source IP used during research.
• 2026-09-08 MSRC continues investigating the reported access, coordinating with Faav on scope and impact before remediation.
• 2026-09-09 Microsoft restricts/locks down the exposed Titan API endpoint, four days after the initial MSRC report.
• 2026-09-17 Microsoft awards Faav a $5,000 bug bounty for the finding.
• 2026-09-22 Faav's technical write-up undergoes Microsoft editorial coordination ahead of public disclosure, continuing through 2026-09-24.
• 2026-09-26 The researcher's write-up and corroborating security-news coverage of the Titan JWT alg:none bypass are published publicly.

Sources cited

• How I Could've Accessed 17 Trillion Microsoft Records blog.faav.net · Proof of concept · 2026-09-26
• JWT Authentication Flaw Exposed Microsoft Titan Analytics Data mallory.ai · Blog · 2026-09-26
• Microsoft Titan Authentication Flaw Highlights the Risk of Broken Trust in JWT Security coesecurity.com · Blog · 2026-09-26
• 16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records cybersecuritynews.com · News · 2026-09-26
• Microsoft Titan Bug Found by a 16-Year-Old Opened 17.3 Trillion Rows pasqualepillitteri.it · News · 2026-09-26
• 16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records cryptika.com · News · 2026-09-26
• 16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records simplysecuregroup.com · News · 2026-09-26

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)

Previous and next in vulnerability

• Elementor Website Builder CSRF Flaw (CVE-2026-62062) Allows Attacker-Controlled WordPress Admin Account Creation (v4.3.0-4.3.1) Previous report
• Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day (CVE-2026-93616) Actively Exploited Next report