A researcher discovered a critical JWT signature validation bypass in Microsoft's internal Titan analytics service hosted on Azure Cloud Services. The flaw allowed forged admin access and unauthenticated SQL queries, potentially exposing approximately 17.3 trillion database rows of metadata including account records, employee emails, database configurations, and analytics dashboards. Microsoft patched the vulnerability on September 9, 2026, after the researcher disclosed it on September 5. No evidence of malicious exploitation was found.
// Get alerts for Microsoft Azure