On August 25 2026, the researcher’s automated tool Antares flagged an internal Microsoft service named Titan that was exposed beyond the corporate VPN. The service’s frontend displayed a “VPN REQUIRED” page to outsiders, but a public Swagger file revealed four API endpoints, of which the /v2/Query route accepted raw SQL and listed Azure AD bearer authentication as optional. Because the Swagger specification did not require a signature on the JWT for that endpoint, the researcher began probing how Titan validated login tokens.
After iterating through token fields—tenant ID, audience, application ID—the researcher noticed that the signature was never checked. By crafting a JWT with the header “alg:none” and an empty signature section, the token passed all validation steps. Setting the UPN claim to the string “admin” satisfied the service’s internal username lookup, granting the token holder the privileges of the local administrator account (user ID 1). With that token, a simple POST to /v2/Query containing “SELECT 1” returned the result 1, confirming that arbitrary SQL could be executed as an admin without any legitimate credentials.
From the administrator position the researcher enumerated live routing values, finding 30 active configurations that mapped to 17 connected analytics databases encompassing 9,863 unique table names. Using metadata queries such as system.tables.total_rows and system.parts, the total row count summed to 17,333,335,124,315—approximately 17.3 trillion rows—covering employee accounts, Bing search analytics, and other internal datasets. The vulnerability was reported to Microsoft’s Security Response Center on September 5 2026, leading to case 144051; the endpoint was locked down by September 9, and the researcher received a $5,000 bounty after coordinated disclosure and a meeting with Microsoft on September 22.