// Microsoft 365HIGH
A 16-year-old security researcher (Faav) discovered a JWT signature validation bypass in Microsoft's internal Titan analytics service on August 25, 2026. The flaw allowed forged administrator access and arbitrary SQL queries without authentication, potentially exposing metadata from 17.3 trillion database rows across 24 analytics configurations and 9 ClickHouse databases. The vulnerability was reported to MSRC on September 5, patched server-side on September 9, and publicly disclosed September 26. Microsoft awarded a $5,000 bounty; no evidence of malicious exploitation was found.
// Get alerts for Microsoft 365