# Microsoft Titan Analytics JWT 'alg:none' Authentication Bypass Exposed Access to 17.3 Trillion ClickHouse Rows

> Independent researcher Faav found that Microsoft's internal Titan analytics service accepted an unsigned JSON Web Token (header alg:none, empty signature) and trusted its claims without cryptographic verification; setting the upn claim to 'admin' resolved to Titan local user ID 1 with the Admin role, letting the researcher run arbitrary SQL against 17 connected ClickHouse databases (~9,863 tables, ~17.3 trillion estimated rows) via the /v2/Query route. Microsoft restricted the endpoint on 2026-09-09, four days after the 2026-09-05 MSRC report (Case 144051), and paid a $5,000 bounty; no evidence of malicious exploitation or customer PII access was found.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2675
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-microsoft-titan-jwt-bypass-tl-2026-2675.webp?v=43446d2c (Threadlinqs threat intel: Microsoft Titan JWT Bypass: Detection & IOCs (TL-2026-2675) — High severity, 8 IOCs, 9 detection rules.)
- **ID:** TL-2026-2675
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

Titan is an internal Microsoft analytics/business-intelligence platform that fronts dozens of ClickHouse databases used for telemetry and reporting (including Bing search analytics). Its web console displays a 'VPN REQUIRED' page, but researcher Faav's AI-assisted reconnaissance tool 'Antares' (built on Codex and Claude models) discovered that Titan's backend API was independently reachable over the public internet via an Azure Cloud Services-hosted endpoint, with a Swagger document listing routes including /v2/Query, which accepted raw SQL text.

On 2026-08-25, Antares recovered 56 historical table/route definitions for Titan from Wayback Machine archives, giving Faav a map of the service's surface before any live probing. Titan authenticated callers using JSON Web Tokens carrying tenant ID (tid), audience (aud), application ID (appid), and a upn (user principal name) claim. Over roughly ten days of systematic testing (2026-08-25 to 2026-09-05), Faav found that Titan validated the presence and structure of these claims but never cryptographically verified the token's signature or issuer. Around 1 AM on 2026-09-05, Faav submitted a token with header {"alg":"none","typ":"JWT"} and an empty signature section (a bare trailing period instead of a signature), replacing the upn value with the literal string 'admin' instead of an email-formatted identity. Titan's backend treated upn as a local application username rather than a verified identity: 'admin' resolved to local user ID 1, which held the Admin role, and a SELECT 1 validation query executed successfully -- confirming unauthenticated, unauthorized arbitrary SQL execution against Titan's connected data stores.

Of the 56 archived routing targets, 30 remained active. These routed through 24 database configurations to 17 distinct ClickHouse analytics database instances, spanning roughly 9,863 unique table names. Using the forged admin session, Faav queried Titan's own metadata database (revealing ~25,000 account/email records, 17,990 employee email records, 15,001 employee/org records, 355 database configurations, 20,979 SQL definitions, and roughly 24,569 dashboards / 425,891 charts / 27,347 dataset definitions) and ran two limited one-row queries against Bing search analytics tables, which returned search-activity records with country/state-level location data and Microsoft User IDs (MUIDs). Faav deliberately limited testing to metadata and single-row samples and stated no customer PII was accessed and no evidence of prior malicious exploitation was found; the disclosed row-count estimate (17,333,335,124,315) reflects the theoretical scope reachable through the flaw, not confirmed exfiltration.

Faav reported the issue to the Microsoft Security Response Center on 2026-09-05 (Case 144051). MSRC asked the researcher to halt further testing and confirm their source IP while investigating (2026-09-06 to 2026-09-08). Microsoft restricted/locked down the exposed Titan API endpoint on 2026-09-09 -- four days after the report -- and awarded a $5,000 bug bounty on 2026-09-17. The write-up underwent Microsoft editorial coordination (2026-09-22 to 2026-09-24) ahead of public disclosure on 2026-09-26. No CVE was assigned, consistent with this being an internal-tooling authentication design flaw rather than a shipped product vulnerability.

The root cause is a broken JWT trust model: Titan inspected structural claims (tenant, audience, app ID, user) while skipping the one check -- signature verification against a trusted issuer/key -- that makes any of those claims trustworthy. This single failure undermined multiple compensating controls Microsoft had layered around the service, including its VPN-only frontend and role-based access control, because an attacker-controlled identity claim could bypass all of them once the backend API was reachable at all. The incident illustrates a recurring class of API authentication bypass (JWT 'alg:none' / unverified signature) with severe blast radius when the exposed service is a data-aggregation platform sitting in front of many downstream databases.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1591.004 Identify Roles
- T1588.002 Tool
- T1190 Exploit Public-Facing Application
- T1606 Forge Web Credentials
- T1078.004 Cloud Accounts
- T1550.001 Application Access Token
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1213 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unsigned 'alg:none' JWT Presented to Public-Facing Analytics API Gateway** (`TL-2026-2675-SPL-001`)

Detects an Authorization bearer token whose JWT header decodes to alg:none (base64 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0') or whose signature segment is empty/missing, presented against an internet-reachable analytics/BI API gateway that fronts internal data stores. This is the exact forgery mechanism Faav used to bypass Titan's authentication and gain an unverified session (MSRC Case 144051).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1606, T1595.002, T1588.002
- **Data sources:** azure_api_management_gateway_logs, azure_application_gateway_waf_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
`comment("Detects alg:none / empty-signature JWTs at an internet-facing internal-analytics API gateway - Titan alg:none bypass pattern")`
index=api_gateway sourcetype="azure:apim:gatewaylogs" earliest=-24h
| eval auth_header=coalesce('RequestHeaders.Authorization', http_authorization)
| where isnotnull(auth_header) AND like(auth_header, "Bearer %")
| rex field=auth_header "Bearer\s+(?<jwt>\S+)"
| eval jwt_parts=split(jwt, ".")
| eval jwt_header_b64=mvindex(jwt_parts,0)
| eval jwt_signature=mvindex(jwt_parts,2)
| where jwt_header_b64="eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0" OR isnull(jwt_signature) OR len(jwt_signature)=0
| stats count as attempt_count, min(_time) as first_seen, max(_time) as last_seen, values(uri_path) as targeted_endpoints, values(ApiId) as api_id by src_ip, dest_host
| where attempt_count > 0
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
ApiManagementGatewayLogs
| where TimeGenerated > ago(24h)
| extend AuthHeader = tostring(parse_json(tostring(RequestHeaders))["Authorization"])
| where AuthHeader startswith "Bearer "
| extend Token = substring(AuthHeader, 7)
| extend TokenParts = split(Token, ".")
| extend HeaderB64 = tostring(TokenParts[0]), SignatureSegment = tostring(TokenParts[2])
| where HeaderB64 == "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0" or isempty(SignatureSegment)
| summarize AttemptCount = count(), TargetedOperations = make_set(OperationId) by CallerIpAddress, ApiId
| where AttemptCount > 0
```

### Sigma

```yaml
title: Unsigned alg:none JWT Presented to Public-Facing API Gateway
id: e3a1c2d4-6f5b-4a8e-9c3d-1a2b3c4d5e6f
status: experimental
description: Detects an Authorization bearer token whose JWT header decodes to alg:none or whose signature segment is empty, the exact forgery technique used to bypass Titan's authentication and impersonate an admin identity.
references:
  - https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
author: Threadlinqs Team
date: 2026-09-26
tags:
  - attack.initial-access
  - attack.t1190
  - attack.credential-access
  - attack.t1606
  - attack.reconnaissance
  - attack.t1595.002
  - cwe.347
logsource:
  product: azure
  service: apimanagement
detection:
  selection_header:
    Authorization|contains: 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0'
  selection_emptysig:
    Authorization|re: '\.$'
  condition: selection_header or selection_emptysig
falsepositives:
  - Non-production/test clients intentionally issuing debug tokens with alg:none for local development
  - Automated API health-check or synthetic-monitoring probes replaying cached malformed tokens
level: high
```

**Known false positives:**

- Non-production/test clients intentionally issuing debug tokens with alg:none for local development
- Automated API health-check or synthetic-monitoring probes replaying cached malformed tokens

**Tuning notes:** Maintain an explicit algorithm allow-list (e.g., RS256/HS256 only) and alert on any token whose header is alg:none, empty, or outside that list; scope the rule to the internet-facing gateway listener to avoid firing on internal service-mesh mTLS test traffic.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unsigned 'alg:none' JWT Presented to Public-Facing Analytics API Gateway (locked: unlock with TL Creds)
- Forged 'upn' Claim Resolving to Privileged Admin Role Without an Email-Formatted Identity (locked: unlock with TL Creds)
- High-Volume Cross-Database Query Enumeration via Analytics Aggregation API (locked: unlock with TL Creds)
- Unsigned 'alg:none' JWT Presented to Public-Facing Analytics API Gateway (locked: unlock with TL Creds)
- Forged 'upn' Claim Resolving to Privileged Admin Role Without an Email-Formatted Identity (locked: unlock with TL Creds)
- High-Volume Cross-Database Query Enumeration via Analytics Aggregation API (locked: unlock with TL Creds)
- Forged 'upn' Claim Resolving to Privileged Admin Role Without an Email-Formatted Identity (locked: unlock with TL Creds)
- High-Volume Cross-Database Query Enumeration via Analytics Aggregation API (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [How I Could've Accessed 17 Trillion Microsoft Records](https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records)
- [16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records](https://cybersecuritynews.com/microsoft-auth-vulnerability-expose-records/)
- [Microsoft Titan Bug Found by a 16-Year-Old Opened 17.3 Trillion Rows](https://pasqualepillitteri.it/en/news/18546/microsoft-titan-jwt-16-year-old)
- [JWT Authentication Flaw Exposed Microsoft Titan Analytics Data](https://mallory.ai/stories/01a0dbe6-d014-7d2b-9295-f2098d33fae1)
- [Microsoft Titan Authentication Flaw Highlights the Risk of Broken Trust in JWT Security](https://coesecurity.com/microsoft-titan-authentication-flaw-highlights-the-risk-of-broken-trust-in-jwt-security/)
- [16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records](https://www.cryptika.com/16-year-old-researcher-finds-microsoft-auth-vulnerability-that-exposes-17-3-trillion-stored-records/)
- [16-Year-Old Researcher Finds Microsoft Auth Vulnerability that Exposes 17.3 Trillion Stored Records](https://simplysecuregroup.com/16-year-old-researcher-finds-microsoft-auth-vulnerability-that-exposes-17-3-trillion-stored-records/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2675